c494b100b3f118180f78b2b3c9c3193fa9880d7620a6bf4ed8b4deff4e8ccc8a

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_74967de1ac86e23567df03adfc099ef2_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260702-y42hmaes21
SHA256 c494b100b3f118180f78b2b3c9c3193fa9880d7620a6bf4ed8b4deff4e8ccc8a
MD5 74967de1ac86e23567df03adfc099ef2
SHA1 098e97d2f5dc238a1e8c5d055c5587894efdeca7
SHA512 92ccda36c56f5a52812b44fc36ad0d6284f2b11f74b606746104344b1fd11cd83d95eeb45a348e28131c9b9efd7b626b151785beeb17735be3ae197af529717e
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dUp+Y8a4mZH2mdaJWKjsCym7HmRd0tC4KIo2J:Qoa1taC070d66aPZHpA7HQ0KIo2+8Cm
TLSH
T113952254F791C2B2C0910671B29287B6D8753EBC56658C87BBC82F3F29A0FC46A7174B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1480	EDA7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1480	EDA7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_74967de1ac86e23567df03adfc099ef2_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDA7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 1480	3516	2026-07-02_74967de1ac86e23567df03adfc099ef2_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_74967de1ac86e23567df03adfc099ef2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_74967de1ac86e23567df03adfc099ef2_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\EDA7.tmp
  "C:\Users\Admin\AppData\Local\Temp\EDA7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-02_74967de1ac86e23567df03adfc099ef2_amadey_elex_smoke-loader.exe 0CE5E3F264264935E7DD8E90268BA2EEE0AE6CEF7DFC2311D2B6B6DC482718066B61B15023E9BD2136B8415E03DC58D29E43002413D07273A8D049AB573C2D71
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDA7.tmp

Path C:\Users\Admin\AppData\Local\Temp\EDA7.tmp
Size 1.9MB
SHA256 4ebf5ea9267d04b4e388fdf0f2839baafc35ece59b747d1961ba08bb27faedd9
MD5 c9201979a618c1280c18311a43e1d273
SHA1 416a9152b1dc29613004ad84b3e3c205caf2de20
SHA512 5d53a14591dce457c31fc790ea1f9a6d27ce665c5e748a87037a7260bcb03995970c752962abe3e8b8d87cb44e7eec141c8128b417cf1f7e75e5520e12828dd3
SSDEEP 49152:Qoa1taC070dWWfDwTZFlhD+rB+sG4XEV/ALN3TO:Qoa1taC03WrwTZFlh6NSaE69q
TLSH
T1BA952350F7A1C0B1D0820532E192C3FAD9A93D7E0A459D837BCD6B7F6960EC46A71B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3516-0-0x0000000000400000-0x00000000005E6000-memory.dmp