910ce106d06bb41b7039f86708d766743b62e3226be96cc1febc1a1240d135f3

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_a15330b4f8a48bb78f654c85142b53de_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 612KB
Sample261022-shpdaads81
SHA256 910ce106d06bb41b7039f86708d766743b62e3226be96cc1febc1a1240d135f3
MD5 a15330b4f8a48bb78f654c85142b53de
SHA1 3388cfd3d23080af4b03335fa0471d48d6e67f13
SHA512 a2a5510959f4d8d37a309e858e7d6e4b20226a963647eef0653572b7d0ff2c02cc3244301db033bbc4c5129e06ac9173d25b0481b4c10221e34e0ad0388bfd48
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8vhyyIFdbTqpeffVDjbZ8PIINq:3YHI93Rq/YgzFdvxjb
TLSH
T187D4F02562C2D133D05A10325B6BD6A27D3A3D352B2B1DC772D4367C6E702C1AAF672B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4664	16BA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4664	16BA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_a15330b4f8a48bb78f654c85142b53de_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16BA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4664	16BA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 4664	1304	2026-10-21_a15330b4f8a48bb78f654c85142b53de_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-21_a15330b4f8a48bb78f654c85142b53de_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_a15330b4f8a48bb78f654c85142b53de_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\16BA.tmp
  "C:\Users\Admin\AppData\Local\Temp\16BA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-21_a15330b4f8a48bb78f654c85142b53de_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 83780A4748560E50C40BDF0BB0804A39E6937D88FCFA19C0BC3FDBD9290A3C893F2F52DB0AB7C6B2E84BD7A0A746C73B2687AD79F8E1B7020361D32D6CCC89B9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\16BA.tmp
Size 612KB
SHA256 2553dc472a921b2340a6e1416a254ab1423512c0c0f85b792d263adb83f99ece
MD5 1aee490c13a8fba9d87ad41866eab864
SHA1 f3541277a5a90fe2308b957676f18659b4785298
SHA512 5799614c9c0e6dd678171a33385e1f7c82e4592610f27d86b452640096ce8a983bc93f497656b05815a661e2112d321f8b54f228174c59a101106b2f0f6dc082
SSDEEP 12288:3wBhHmq7dq93QKqZwe/8EYLABpRmNd6gW6yKpFqH0akIxpZnsNq:3YHI93Rq/1YLABPmHtF+0akcfs
TLSH
T1B0D4F06070C1C173E09704321A5AD7A62C7A3E355B2A5DCB72D4377DAE712C1AAFA327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download