f19a9b46582b4044bf9942e6dc142bd240e7dadd6e6b86ce911a91a187f877ef

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader.exe
Size 428KB
Sample261104-vrz79aes2m
SHA256 f19a9b46582b4044bf9942e6dc142bd240e7dadd6e6b86ce911a91a187f877ef
MD5 7103566b2cf498ed1fcae28f1ebd61f5
SHA1 804012559de846e57b4c1c14eefd97a04e8bc61d
SHA512 03b9a5f3a82f82152809712e568b4e57c11f78e9f989c88f75931b73044692efd9fca23c2d5f14e413d9ecf55ae3fb4daa36a3b49480f30b1f9358818e380fe6
SSDEEP 6144:ZhEhUR7NXRNcctWZzL2SeCi+AkDG/Jl7kP6YYUayvLHHZlofiDP9LtQtyfWJ:ZhEhQ1MLm+ANxl7kP6YYUDvLXoEVLOy
TLSH
T11A94BF14ABB0C034F5B716B89A799369B93E79E16B3894CB63C726DE46356D0EC30307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	4580	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7103566b2cf498ed1fcae28f1ebd61f5_amadey_elex_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 312
  2⤵
  - Program crash
  PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4580 -ip 4580
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4580-2-0x0000000004FD0000-0x0000000005009000-memory.dmp

Download

memory/4580-1-0x0000000003410000-0x0000000003510000-memory.dmp