25f4eabfd20eda53bb305681ab96b0861eb7196c524419f9b02ce3e7ce44a849

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 19:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_cd752c1b846b4b3d07c93c7d88c864db_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260702-x7jasads6x
SHA256 25f4eabfd20eda53bb305681ab96b0861eb7196c524419f9b02ce3e7ce44a849
MD5 cd752c1b846b4b3d07c93c7d88c864db
SHA1 54f3bb19694d4a90f39ca37dc6465795f97f5ddc
SHA512 bfdad08ce7da2b5eecad77449d985c3458d6715822bd64a16b60a29bc02fd869f26cb78eb596730d3737400b81db1d10f33cefc15927d5148a3e4fc8360cc2a1
SSDEEP 49152:ioa1taC070UaCLHJzmlNMP39kdlkIPaHdy1se62F45QvOJFIRU:ioa1taC0RzkNMVkd4HdMLO
TLSH
T17DA50200B300F0F3C5156FB0665AEB9FA57039FF7745C88A7984179A19DBAC8A712F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3736	7153.tmp

Executes dropped EXE 1 IoCs

pid	Process
3736	7153.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_cd752c1b846b4b3d07c93c7d88c864db_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7153.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 3736	5852	2026-07-02_cd752c1b846b4b3d07c93c7d88c864db_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_cd752c1b846b4b3d07c93c7d88c864db_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_cd752c1b846b4b3d07c93c7d88c864db_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Local\Temp\7153.tmp
  "C:\Users\Admin\AppData\Local\Temp\7153.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-02_cd752c1b846b4b3d07c93c7d88c864db_amadey_elex_smoke-loader.exe 7BF52FD4E5279CD1B9C51BC9D3DDE6E01A0CD0428D942D3E85216CE784D33E48C78A7BDCCE2A169C5404ACD8659D51E23E58D3869175212FFA7E2C8ACB46C05C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7153.tmp

Path C:\Users\Admin\AppData\Local\Temp\7153.tmp
Size 2.2MB
SHA256 dfad83e38a2f180574bb46c8bcbcc4be6003e282fbad2da9581ff87bb8e9742b
MD5 9bbbcb9ab0a557ddf592b19bff1b407d
SHA1 fe4cbed2dab5f08b1bc9c40aa41c6dd1adff5062
SHA512 4aa1fb97d68b25924db20965e7ad7e74e885f71c8c72cb02ff4910b84ed28681a16cfb87eb0601279f200bf2f3545ce688709ac077135f099e744b20dc987c34
SSDEEP 49152:ioa1taC070UXXyU5xBf3wmaCRTgSV5FUvma0xQvOJFIRU:ioa1taC0BXLNYCi4E8d
TLSH
T12AA50200F314F0F3C5456BB0664AEB9FA67069FF7B459CC73984269A19CBAC89702F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download