bf31622b8d39a44fe52e9487e186779e170898f185ac1c90fba02d7a27d39a8a

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/11/2026, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader.exe
Size 413KB
Sample261103-bs8q8s1x2l
SHA256 bf31622b8d39a44fe52e9487e186779e170898f185ac1c90fba02d7a27d39a8a
MD5 b0e609ca29db411f61a993604e0a435e
SHA1 8a9d03d70e1b32441681f6ce9b9e4ea00e530a9d
SHA512 5565c189909f5c0ce1da2ce213389e9c057ca77398fed223f3f92a15d579c188b20aa451ca7117775b055d4782e0ac4adaac1d32055e799e729566467008e63b
SSDEEP 6144:O75XQdc3aSalj7jz1EKPfL9uPIKoQrzVVKK4ZVT:OdXQdcfaJVE00PIKoQrLKK
TLSH
T10594AD107BA0C035F5B716B459B993B8B93F7DB1AB2490CF62D52AEA56346E0DC3070B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2572	3892	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_b0e609ca29db411f61a993604e0a435e_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3892 -s 292
  2⤵
  - Program crash
  PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3892 -ip 3892
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3892-1-0x0000000003560000-0x0000000003660000-memory.dmp

Download

memory/3892-2-0x0000000003510000-0x0000000003540000-memory.dmp