55fbc200b77d9cf52b44fc7d6f87f1d4720a5fea741ae17b6e9c01d417345810

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_8e08ef119f3dacaae316d14c0329347a_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260707-ctsbbafz8x
SHA256 55fbc200b77d9cf52b44fc7d6f87f1d4720a5fea741ae17b6e9c01d417345810
MD5 8e08ef119f3dacaae316d14c0329347a
SHA1 e66b25dcb7e6012e8948539d1cf14f3c26eda9a9
SHA512 76bde1c1849e91a0a33b2b4539e65687afc46cbeda5d413999242139018c996bf64226b8483dbc1e39d776dfe67e4b7c5518256334728e7eeafa0c1b0aad7c0c
SSDEEP 24576:62oo60HPdt+1CRiY2eOBvcj3u10UnyyM58ktU4dzJfcc2Sxd7IaaPdkjWmX4PD:Doa1taC070UnBM584UcRccdXn48WmeD
TLSH
T12F66BC00916AF3658A802930997EB159D4E4ADA487FD48F33E8C7AF9D773BE37532201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4828	1FD3.tmp

Executes dropped EXE 1 IoCs

pid	Process
4828	1FD3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_8e08ef119f3dacaae316d14c0329347a_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1FD3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5600 wrote to memory of 4828	5600	2026-07-06_8e08ef119f3dacaae316d14c0329347a_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_8e08ef119f3dacaae316d14c0329347a_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_8e08ef119f3dacaae316d14c0329347a_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5600
- C:\Users\Admin\AppData\Local\Temp\1FD3.tmp
  "C:\Users\Admin\AppData\Local\Temp\1FD3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_8e08ef119f3dacaae316d14c0329347a_amadey_elex_smoke-loader.exe 2927B8A40DA2E1EF15AE8265BB86E1CBADEBFE7CF567A6126FE0DC9CBE79FA2AD782F23A8DB02ED84A7E35D96460DC084B623AD949E6593DC81F60E9F8F4E3B4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1FD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\1FD3.tmp
Size 6.5MB
SHA256 30931570a1cf64e5a28300ca7d6173c86f805ea802a91ac8582983dfd56af3b3
MD5 5ab75b70462aa89f90814f27d2049bd7
SHA1 17d97c7ab29ad7af98fa9dce580dbc45abe62643
SHA512 3eb13307c901a84a52c90060a1061c190fa979f42062dbeaf74b6d7f351544e12a4d5a0a3d7dbe4aa8bf767ce36011cdc52d93a2e2031b2b8c5baf47f7a8b233
SSDEEP 49152:Doa1taC070UW98T6FFVo6fu2o1+lu9Q+N7BOS5:Doa1taC0c98T6FXrURLOS5
TLSH
T1C166CD10656AF3618A812970987EB159C4E5ADA487FC48F33D8C3AFAD773BE37532601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4828-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5600-0-0x0000000000400000-0x00000000005EB000-memory.dmp