4468eefe2feb8584982525050f94863e9e8980d3a4f10fb075b88b6875cf1b7d

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_44e7975829f6806ccf2541d89a175667_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260702-wef5aaa191
SHA256 4468eefe2feb8584982525050f94863e9e8980d3a4f10fb075b88b6875cf1b7d
MD5 44e7975829f6806ccf2541d89a175667
SHA1 2488a9ab35c7ec98951ecdf768fcdf3ae056ab8d
SHA512 06ef0e7e3deaa988838fb958a755dce523b7a73779ae5f415069530cf15f5783ba39278991cd884f3bf2ce34a09e9e490afe527f6f5345b2e7e42719c0620ef2
SSDEEP 49152:Qoa1taC070dyxSQCg/U/licC43An7UDesTVP:Qoa1taC05Dh4edsN
TLSH
T195952351F795C2B1C0D10A31A196C3E2ED693DBD16468C87BFC85E3F2AA0EC06672767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3428	2AA0.tmp

Executes dropped EXE 1 IoCs

pid	Process
3428	2AA0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_44e7975829f6806ccf2541d89a175667_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2AA0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 3428	3772	2026-07-02_44e7975829f6806ccf2541d89a175667_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_44e7975829f6806ccf2541d89a175667_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_44e7975829f6806ccf2541d89a175667_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\2AA0.tmp
  "C:\Users\Admin\AppData\Local\Temp\2AA0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-02_44e7975829f6806ccf2541d89a175667_amadey_elex_smoke-loader.exe 00C2C508B700251C308CA37F6C0857E3E3F6626830381C07196FE62B1E47406046EDADC74CBCD6CB3D4AE338E4BA079BA5AF024E0B74972D83E81674C8222438
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2AA0.tmp

Path C:\Users\Admin\AppData\Local\Temp\2AA0.tmp
Size 1.9MB
SHA256 c3d10409c98f214a3558278b0c9bdc1d6906669dfef63687597c9aa24c48b0ac
MD5 734a14e3db4d9df413163cc56262a9e6
SHA1 a96b31d51d19c0841b7f9f0c18d763b8419ebd58
SHA512 2ae86f63ed3c3e3e6a27d7dfb36e6297270c992148c5456c8e9190fbd033915dc1761954438c516815cb292f3566c256b9b06ac31371db52501f73dcf2b76bbd
SSDEEP 49152:Qoa1taC070dBO9Q02rWpa0Y9348O4WT67:Qoa1taC03Q02rT0y44W+
TLSH
T1F7952354F3D5D1B2D0910AB0A562C3E6D8A93D7D63465D837FC82A3F2864FC0AE2674B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3428-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3772-0-0x0000000000400000-0x00000000005E6000-memory.dmp