854a07806d1dd0ef8326d5f548aaaa0f532fc5ea661d2bd07bed6d9f898a717d

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe
Size 2.1MB
Sample261024-yv9smsff97
SHA256 854a07806d1dd0ef8326d5f548aaaa0f532fc5ea661d2bd07bed6d9f898a717d
MD5 1b214faa6b884e2ae47cbdd6f4de40e2
SHA1 215759ff65a748f2aed093b64e7690ebcb7f9907
SHA512 620c9825f6176f5e5e44640ea38bdf3f0ca7917221098c6552ae786e8479f22b102aab050d6a6a69915cacadb950f7ae7c44921d00a4208ace641aa6f8b45a3b
SSDEEP 24576:qENJKEt6dq8hXj8R2vxW870KHAe5GqR6FokG81Cvz44sLy0aZJQ5Te6LlQhA:qENwzIR257BDIqR6FoRvku04YL
TLSH
T1F5A54A10AB508028FAF752F55AADE16C952C7DF0879860CBB1D576FA86366F02D3334B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 18 IoCs

pid	Process
4840	USBMonitorSrv.exe
3712	Daemon.exe
4640	host.exe
3092	Daemon.exe
4060	Daemon.exe
3568	Daemon.exe
1436	Daemon.exe
364	Daemon.exe
716	Daemon.exe
668	Daemon.exe
2008	Daemon.exe
2452	Daemon.exe
2596	USBMonitorSrv.exe
1816	yyzUSB.exe
1620	host.exe
1016	Daemon.exe
1416	Daemon.exe
4396	Daemon.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File opened for modification	C:\Windows\SysWOW64\copied.exe	yyzUSB.exe
File created	C:\Windows\SysWOW64\host.exe	yyzUSB.exe
File created	C:\Windows\System32\jaccessinspector.log	host.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	USBMonitorSrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yyzUSB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daemon.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4840	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	85
PID 3384 wrote to memory of 4640	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	87
PID 3384 wrote to memory of 3712	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	86
PID 3384 wrote to memory of 3092	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	88
PID 3384 wrote to memory of 4060	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	89
PID 3384 wrote to memory of 3568	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	90
PID 3384 wrote to memory of 1436	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	91
PID 3384 wrote to memory of 364	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	92
PID 3384 wrote to memory of 716	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	93
PID 3384 wrote to memory of 668	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	95
PID 3384 wrote to memory of 2008	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	96
PID 3384 wrote to memory of 2452	3384	2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe	97
PID 2596 wrote to memory of 1816	2596	USBMonitorSrv.exe	99
PID 1816 wrote to memory of 1620	1816	yyzUSB.exe	100
PID 1816 wrote to memory of 1016	1816	yyzUSB.exe	101
PID 1816 wrote to memory of 1416	1816	yyzUSB.exe	102
PID 1816 wrote to memory of 4396	1816	yyzUSB.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3384
- C:\USBMonitorSrv.exe
  /i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4840
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3712
- C:\Users\Admin\AppData\Local\Temp\host.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Daemon.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_1b214faa6b884e2ae47cbdd6f4de40e2_amadey_elex_remcos_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  PID:2452

C:\USBMonitorSrv.exe
C:\USBMonitorSrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\yyzUSB.exe
  "C:\yyzUSB.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\host.exe
    "C:\yyzUSB.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1620
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1016
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - Executes dropped EXE
    PID:1416
- - C:\Daemon.exe
    "C:\yyzUSB.exe"
    3⤵
    - Executes dropped EXE
    PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Daemon.exe

Path C:\Daemon.exe
Size 454KB
SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
MD5 6175b5dc639ebb11fc708a67b4e7a3e3
SHA1 d8f5a80e548ec700cfa0b85293ea15e8b4141e8c
SHA512 8653c2fd4107cf636fca88446ce6bdc3262ad61376eb464096e2d1bf48d2b807c4e09c98fcd5a070f296d0e1314f8d8b3e439ec70697d3198a5f962e750b4007
SSDEEP 6144:G7JJY5Hebd8Rr6FoYpD6Ws0la8CFt4X8/nClI1wyhmz1q:WJY5HmqRr6FoYpDan8q+86lIyI
TLSH
T1D2A438016A60C029F3B673F46A6EE168945D7DB04768A4CFE1E57AF986301F26C3325F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

USBMonitorSrv.exe

Path C:\USBMonitorSrv.exe
Size 694KB
SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
MD5 9ac3dc0ce15644d39b039527d942685c
SHA1 a08e14954fd47f58eeec36e9942a12557066c7d1
SHA512 360d31a9e66802a18610c8688be17c3bbf762db62c0f36a1b20477d42648bacbd8a0d50a54d05f1745fbb576c87878716242bdc2e7b81dff276e592d37182522
SSDEEP 12288:GHtTeTvIchy4LoLtlG8ZtwJ0ofJ2/5v7nL9Hwn6Lz:gCvz44sLy0aZJQ5Te6L
TLSH
T10FE45A10BB518429FDF751F54AFEA17C952C79B0DB9C20CB60C953EA463A6F02E36287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

copied.exe

Path C:\Windows\SysWOW64\copied.exe
Size 2.1MB
SHA256 854a07806d1dd0ef8326d5f548aaaa0f532fc5ea661d2bd07bed6d9f898a717d
MD5 1b214faa6b884e2ae47cbdd6f4de40e2
SHA1 215759ff65a748f2aed093b64e7690ebcb7f9907
SHA512 620c9825f6176f5e5e44640ea38bdf3f0ca7917221098c6552ae786e8479f22b102aab050d6a6a69915cacadb950f7ae7c44921d00a4208ace641aa6f8b45a3b
SSDEEP 24576:qENJKEt6dq8hXj8R2vxW870KHAe5GqR6FokG81Cvz44sLy0aZJQ5Te6LlQhA:qENwzIR257BDIqR6FoRvku04YL
TLSH
T1F5A54A10AB508028FAF752F55AADE16C952C7DF0879860CBB1D576FA86366F02D3334B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

host.exe

Path C:\Windows\SysWOW64\host.exe
Size 103KB
SHA256 792b89cbd462e51406849e6927737f60e5fbd6b2390f7d07237387a9c9c2b510
MD5 5b72c9c60282f6a7b6e5332188943b1f
SHA1 a6004276c40e5d68c5ded16cb9816154be87731a
SHA512 1298978c39a4df42101f62c47b064a37003d72266ce808b3fc7a58c76c3c634e476db744a0c10d5bc382908bf32189440ec0719ca400b5709efbba60d1e79c60
SSDEEP 3072:YvaBU1Lhceff4Sx7nrl/RZZOH7rFxAXX4J1WXoTa00liUNLIcUaZ4aE68Mezni9t:e4U1Lhceff4Sx7nrl/RZZOH7rFxAXX4m
TLSH
T18EA3B34BAB9450D5D8F6C0B894E1A61AEA3131E98330E7DFA794440F4F62BD0BD3DB49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\service.log
Size 431B
SHA256 79572d930d1516a2ecc468e58eefee605b7e9f578787cf7df587598e4dd04f40
MD5 5077ea918e543972aa7c981eaaf49c7b
SHA1 8efef7d8567894cd6b46050c051104e158abe706
SHA512 fbd741d6e3c26ce6232ba6f1eeb4c0846129cd3919e6599258ec5566f43da498e90eef350546227cc7c7f63600f6b4db55f2ef2ced1099b0464be316ad7a1992
TLSH
T1E8E0ED4110C812F3C6C22429AE932388DF5B32281C3CB49183FA3D2930DBD0D60A8696
MD5 SHA1 SHA512 TLSH

Submit Download

memory/364-37-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/668-40-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/716-39-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/1016-80-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/1416-83-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/1436-36-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/1816-68-0x0000000000F50000-0x00000000011B2000-memory.dmp

Download

memory/2008-43-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/2008-41-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/2452-44-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/2596-52-0x0000000000DF0000-0x0000000000EE6000-memory.dmp

Download

memory/2596-86-0x0000000000DF0000-0x0000000000EE6000-memory.dmp

Download

memory/3092-33-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/3384-82-0x0000000000370000-0x00000000005D2000-memory.dmp

Download

memory/3384-1-0x0000000000482000-0x0000000000483000-memory.dmp

Download

memory/3384-0-0x0000000000370000-0x00000000005D2000-memory.dmp

Download

memory/3568-35-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/3712-32-0x0000000000EF8000-0x0000000000EF9000-memory.dmp

Download

memory/3712-31-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/4060-34-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/4396-85-0x0000000000E70000-0x0000000000F0C000-memory.dmp

Download

memory/4840-78-0x0000000000DF0000-0x0000000000EE6000-memory.dmp

Download

memory/4840-19-0x0000000000DF0000-0x0000000000EE6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads