c550b4765e21dab0c83185b19c32bcead3863898511ed2c8019f24b63b9a9f6f

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_99c615def28bedeb0ea5aba85e057e36_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260707-che7lsfy2t
SHA256 c550b4765e21dab0c83185b19c32bcead3863898511ed2c8019f24b63b9a9f6f
MD5 99c615def28bedeb0ea5aba85e057e36
SHA1 f7200ec787a63db4bce7d87bb48ecfba2c0fb10d
SHA512 f6d9cdb2494b2416813e54e5362f4f370618f41485abaa5a44173f5f0eb0d951c8179141e6000d8c652a6113e77e8116bb2059723cdd60e923a68a2c6599acd9
SSDEEP 49152:Qoa1taC070d3WYuJmmrcQcBmKHIMT21X1xhvyqtf3XU+O/:Qoa1taC09YuJmmrE3To1jyqtfpQ
TLSH
T1FC952262F791C2F2D4814671A992C3A3DCB93E3C17158DC37BC9162F29A4ED11A3A74B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1680	E4AE.tmp

Executes dropped EXE 1 IoCs

pid	Process
1680	E4AE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_99c615def28bedeb0ea5aba85e057e36_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E4AE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1680	788	2026-07-06_99c615def28bedeb0ea5aba85e057e36_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_99c615def28bedeb0ea5aba85e057e36_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_99c615def28bedeb0ea5aba85e057e36_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\E4AE.tmp
  "C:\Users\Admin\AppData\Local\Temp\E4AE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_99c615def28bedeb0ea5aba85e057e36_amadey_elex_smoke-loader.exe 97561BE609B0830858932C3B3936CF0BB98D2B8BD3A7E499692460A7BBCD9F039440860FDB606A294D7AC8526FCD0CB3335FBEC3C50FDFC78B19C57B365A4220
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E4AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\E4AE.tmp
Size 1.9MB
SHA256 48d9fab15cd112ef155115ef182fb3cba423c81e86c78654005ce3aa3c1bae27
MD5 b3d27525f23580e4e3fcc12d127cd15e
SHA1 a5d637660b096819e050e7cec878aba9f76f0b7a
SHA512 cad9ff763e9d26d3ebe24ba0bd167d919a9da3ebcdfbd58114b7a6b8afd34b3eb8f8677ea9c2a75b7f78fafbf1bcf38c3d47602d6bbf726cc9b6998d077e73f2
SSDEEP 49152:Qoa1taC070dWrqhymU8LlHqwV25Wjb3uqvHiu/:Qoa1taC0+1NlKt5opfiw
TLSH
T1F19522A0F695C1B2D4914A35E292C3E2DCB53D7C5B458D876BC90B3F2EA0EC06A71B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/1680-6-0x0000000000400000-0x00000000005E6000-memory.dmp