f7d31e6ec51252dccae6de87c34c6e419f893c0154a6dfe5b13316bf7ce43cbd

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 00:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_3b651987bcf5e8f0d4856e923d7d01af_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260703-a7tp7ad14k
SHA256 f7d31e6ec51252dccae6de87c34c6e419f893c0154a6dfe5b13316bf7ce43cbd
MD5 3b651987bcf5e8f0d4856e923d7d01af
SHA1 e9676892dab370fff18fa13934bbeda0c63e265f
SHA512 ebc4780b418e9cca0536e155dbdce3488e435ffb6447378af8e4e0212f11ee96730a60df2f2eb147cb3275bc13dd74760af0bc05b4480a4dbcd25be7fc52a4b0
SSDEEP 98304:emhd1Uryet4gG7LOCfcVizVMiV7wQqZUha5jtSyZIUS:elAHOCHzp2QbaZtlir
TLSH
T18356BF05EBE8EF1EC51F03B590B2222657FAD894E783AFD6A941F5B07E82350BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3020	57AB.tmp

Executes dropped EXE 1 IoCs

pid	Process
3020	57AB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_3b651987bcf5e8f0d4856e923d7d01af_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57AB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 3020	4488	2026-07-03_3b651987bcf5e8f0d4856e923d7d01af_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-03_3b651987bcf5e8f0d4856e923d7d01af_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_3b651987bcf5e8f0d4856e923d7d01af_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Temp\57AB.tmp
  "C:\Users\Admin\AppData\Local\Temp\57AB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-03_3b651987bcf5e8f0d4856e923d7d01af_amadey_elex_smoke-loader.exe D9E37A35E22752799E2E9D9C653750B38D6ED5A5B6C0F02B966805AD3D0ADAE7F6A0E2B5581ECE77974D46F62693CFFCDEE0D92500B92CEC6BED1F0FE6965E5C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\57AB.tmp
Size 6.0MB
SHA256 0c249bb497e5f8770f08ab921daecf0cf02f82e551c62f2b77e7f61c9a5b9c11
MD5 3cc263737d8d0b1c90efa8224e7c15e8
SHA1 e0321091699cbacebe3a5a3b9f05a39794a94f40
SHA512 25beaa495e019d9ae372d1ee347ef49e78119e1ead6b27026f6d4789a4fb238c356563982111b001ccb25c7d8442fda94c8b43182b66e7b2aa515574b277f013
SSDEEP 98304:emhd1UryeVg5j01ADeV7wQqZUha5jtSyZIUS:el1glGADe2QbaZtlir
TLSH
T10E56BF05DBE8EF1EC91F03B590B2222657FAD894D783AFD6A951F5B07E82310BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3020-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4488-0-0x0000000000400000-0x0000000000849000-memory.dmp