f249f4aa5f7a5bbd7a5aaf9ce50ba425ca25b951445c0b7df687eba3aa323f83

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_9ae99c1644f199e0cb4718b29aae1c73_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Size 532KB
Sample261110-pff3cafb98
SHA256 f249f4aa5f7a5bbd7a5aaf9ce50ba425ca25b951445c0b7df687eba3aa323f83
MD5 9ae99c1644f199e0cb4718b29aae1c73
SHA1 426b7345de0e2adbb249fab88e1edb3d30472e6d
SHA512 94f7f5eafc793813106bd3aaf9623e37e2259317c9f1e4191a7e938f97a31764270e144f6bbcfba31b8db209a9c3e041966d3b9c1a8972c873c61041d4da8b89
SSDEEP 12288:KdcAIffrC9fdm7na4VhJNP7iph1qJO9N7fn5nPm:KdpInm9fdmu4VhsTpRn5Pm
TLSH
T19AC4F06122D3C1B2D19601321B9BCBB22C3A79355B295DC776D0777EBE306C1A6B231B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
940	9AFE.tmp

Executes dropped EXE 1 IoCs

pid	Process
940	9AFE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_9ae99c1644f199e0cb4718b29aae1c73_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9AFE.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
940	9AFE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 940	4436	2026-11-09_9ae99c1644f199e0cb4718b29aae1c73_amadey_elex_remcos_rhadamanthys_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-11-09_9ae99c1644f199e0cb4718b29aae1c73_amadey_elex_remcos_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_9ae99c1644f199e0cb4718b29aae1c73_amadey_elex_remcos_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Local\Temp\9AFE.tmp
  "C:\Users\Admin\AppData\Local\Temp\9AFE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-11-09_9ae99c1644f199e0cb4718b29aae1c73_amadey_elex_remcos_rhadamanthys_smoke-loader.exe C69D052B22CF9D276449F5F15E0FAF58DA6F8F7FC55BEFF3101035C0C3088E7E28A457F9687B70FD07E51A090FB7C90226A1685823CE7D86E6AEC929097C6BCA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9AFE.tmp

Path C:\Users\Admin\AppData\Local\Temp\9AFE.tmp
Size 532KB
SHA256 91dabe5bc53e34764b2a99cd7677ab31cc203a9bf486aa0a76034a1eaa166e14
MD5 a79d10836b3ddd2e9bc7bbd2afa35a80
SHA1 93c8be1a08a2926cf49aba502f6b5b13f42f5d64
SHA512 2abdf5550d6a6835bf2d778718a77460f6cd28f3d920939c0dc7671eab79bc1563742f778623d07679e92e6385a2fe81f956145902e030e50aa460649d9a6554
SSDEEP 12288:KdcAIffrC9fdm7namwvITxP8ccCL3N7fn5nPm:KdpInm9fdmumwQTYCL3Rn5Pm
TLSH
T168C4F01172C291B2E08A14331B6BCBB22C7A39305B295EC776D4777DAE316C2B6B5317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download