c9ad6e73560d6885f2b93db903224c1ec0b0fb9129609ee3f7afa37088dcf9c5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260707-cfehasfx61
SHA256 c9ad6e73560d6885f2b93db903224c1ec0b0fb9129609ee3f7afa37088dcf9c5
MD5 9ca5f5c24cc16063ac7a250b2f0c4d3c
SHA1 631282d6b723c640d158eb78ed7790dcd9359f10
SHA512 91fa9a17a71632c821f3f3b44570bb44843a65e309d14301f0496c78d8d849c705774db63fa53b4f8de26bb0ccd00410048c7c1c388dd187c57d344f3481aebd
SSDEEP 49152:Eoa1taC070UKJdJkSS+Y0i1HFAuU6lLmebMU/n6Yf9xgqFqvOJFIp:Eoa1taC0edJkifEHFEKDbMU/ff9K
TLSH
T1DAA50201B754B0F2C5541AB0A455CBD3A661787BBB019DC36E84635F4CABBC8AF63F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2672	4617.tmp

Executes dropped EXE 1 IoCs

pid	Process
2672	4617.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4617.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2672	3496	2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\4617.tmp
  "C:\Users\Admin\AppData\Local\Temp\4617.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe 1CB9F894411A3DB892A649FA4C2AD684026F8368F137D46F714BA6138C2C5AEDC401B563B0EDB57D4BCEFECF3855E7A407058F02837DE3AA1EC94799BFB3567E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4617.tmp

Path C:\Users\Admin\AppData\Local\Temp\4617.tmp
Size 2.0MB
SHA256 1b57a3a7af10e00ea7c212a29df74b0d091751369eddb9d3c5d7d3d3ee3d42fa
MD5 8e283b7ddc4ac65727a542b6a35af760
SHA1 1199dcc8237c89cef89bd34b47acdbdc0950fb5a
SHA512 8bd5edf2e8148b2ddfec2540fed84e5d09f259070eaf0559ca204830b2f0137f52d89967a96e546f87b226f9c7441812ba2201f713c372fd65ddcb412cd1ad04
SSDEEP 49152:Eoa1taC070UWu7BG7h+/RKLZmbVQc4qvOJFIp:Eoa1taC017B/y6Qcb
TLSH
T15CA50211B704B0F3C6155A70A896C7D3A6617CBBBB419DC36E84235F4C97AC8AF53B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download