f4c360563b7df7f671b57fb73a76efa8b44b09769908d5bf0a8ff77b4762170f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_436baaf50454ab7bf55d84538a77b60f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 676KB
Sample261024-sfzq8saw21
SHA256 f4c360563b7df7f671b57fb73a76efa8b44b09769908d5bf0a8ff77b4762170f
MD5 436baaf50454ab7bf55d84538a77b60f
SHA1 9665eacf72a156e7bd9eedb45daa44dd47e424a5
SHA512 44d2ca1cf41697179e4ec139549fac355490864fd010e2797cae4e6724394dd4a44d87d9bc613d8cff8add1b20a3c451207b42d8741757f7560a1b1a896d3f1e
SSDEEP 12288:hfNzTW2Qz9H4vROWO8SnUvAqyZUs8MIzmN1fWr9tUx0K6cisk2ZvxN7fn5nPm:hfhw9H4vROWO8SnjvOsPIzmN9Wr9t8AP
TLSH
T192E4F16271D29177E18614324A6AC7A12C797E311F2AAEC733D02BBC7D712C176B139B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2040	1AF1.tmp

Executes dropped EXE 1 IoCs

pid	Process
2040	1AF1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_436baaf50454ab7bf55d84538a77b60f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1AF1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2040	1AF1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 2040	1420	2026-10-22_436baaf50454ab7bf55d84538a77b60f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_436baaf50454ab7bf55d84538a77b60f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_436baaf50454ab7bf55d84538a77b60f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\1AF1.tmp
  "C:\Users\Admin\AppData\Local\Temp\1AF1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-22_436baaf50454ab7bf55d84538a77b60f_amadey_elex_remcos_rhadamanthys_smoke-loader.exe 56CE6B0822AB27BF51271D40ADA82C031A79DC0DD46717CBAA0D4332004EAF32700502442E00E219DFFE6278C85AA05FACD9600D7DC2BB8A04E60EDC4A1EABB9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1AF1.tmp

Path C:\Users\Admin\AppData\Local\Temp\1AF1.tmp
Size 676KB
SHA256 303d1d2c53451ca61c91cb85b781f1c3023737bff0e7967110caa9da20fc0242
MD5 e6546b0a2d8d4b8c9eb18cd923dd5758
SHA1 b8772086ad98ce25bdc73cc53e9d3b2a23f631be
SHA512 a0060ff5b38ad4aeaa9a516727e65cc99cbd23b54aabe43212e4eb108f2b6fcae2f9078dd0aeb7039f64f22164e5ae577799828f2c109d3a6bc086058d3e84fe
SSDEEP 12288:hfNzTW2Qz9H4vROWO8SnUvAqIYcgvyqTsRNy0NFWPSAcbzeN7fn5nPm:hfhw9H4vROWO8Snj4oqTeo0FWP0biRn
TLSH
T1B2E4012275D28172E18308325957C7A12C357E321B2A6EC771D43ABDBE717C2BAB1397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download