737f63b6ccc7f7674496221bbedb0e4fe145af4d6469da00819914588c3d016e

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_d53298a20fb4f9e3c992ec76f1ec85d3_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260704-vsrmhaet2l
SHA256 737f63b6ccc7f7674496221bbedb0e4fe145af4d6469da00819914588c3d016e
MD5 d53298a20fb4f9e3c992ec76f1ec85d3
SHA1 635af40a9f53e419b319d0d6a2c27ef0ae38c41e
SHA512 57a9e38d3c75846b04a3bad2937f85839997131849284578b08b7e2df653f520230311969da8049fca5b0e40306029cd2ed6c455fadd524c8164f803bf3fb620
SSDEEP 49152:hoa1taC070Ufo1zcd4luhv6lcVWkn5T0r/Qdp+zay:hoa1taC00zWqgv6UDeQI
TLSH
T155B50153F78195E6C5590172AF408281972AE531AB0B47837A9C131ECF937CB9FA2E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3688	DFAD.tmp

Executes dropped EXE 1 IoCs

pid	Process
3688	DFAD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_d53298a20fb4f9e3c992ec76f1ec85d3_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DFAD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 3688	4616	2026-07-04_d53298a20fb4f9e3c992ec76f1ec85d3_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_d53298a20fb4f9e3c992ec76f1ec85d3_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_d53298a20fb4f9e3c992ec76f1ec85d3_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\DFAD.tmp
  "C:\Users\Admin\AppData\Local\Temp\DFAD.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-04_d53298a20fb4f9e3c992ec76f1ec85d3_amadey_elex_smoke-loader.exe 975E2FCED30BCDED351F4B793C6D71293E304CB48EB1F4EA68CED73DDD8363938AEBE21533FFCFC6AB62A469836BF6A843BCC044505A9467C0087CA2F61E7A7C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DFAD.tmp

Path C:\Users\Admin\AppData\Local\Temp\DFAD.tmp
Size 2.2MB
SHA256 e7e11ac857045c9dd4faea296de6a88b72a44231b6954a36f87ffa7bed174549
MD5 4b3d1294405e5a04c655b77a4692e3c7
SHA1 331284e55f70dc1698eb7a1ffe86f9f1cf86bfdd
SHA512 b34c461bff38a8d165e1c8d476c1dc069f998dbd4621f854d53400c868dbfef9653ac752b68fc84e7ed22415cace56e0cbd7891ceffe27e4378ee7143b4ea43e
SSDEEP 24576:02oo60HPdt+1CRiY2eOBvcj3u10UiK+tlXFOco6H0MBzOLf+MGYTYKcUqbpSqdFz:hoa1taC070UIVfHHz4GY8UqseSuX/b
TLSH
T183B5F153F78295E6C1990175AF508281972AE431AB0B07837A8C171ECF53BCB9F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download