36da9b09ecd28f0e18a43aed72283d1e49aaa4b3a4152044c5c56afb4cee9948

Analysis

max time kernel
148s
max time network
98s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_314f695df997c006de71558fd8bb49a2_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260707-e6stqahy7s
SHA256 36da9b09ecd28f0e18a43aed72283d1e49aaa4b3a4152044c5c56afb4cee9948
MD5 314f695df997c006de71558fd8bb49a2
SHA1 8846db8a43e968c485eec6c38f24cdd6f8183766
SHA512 9767a7e8a86f2e70ae2cf23612679a48b502512d5ea94d012aaf61b281b42476dca02ec0460dfb28073fe30a09e00ecc0182c01211a8e8e957e64f086530e3b7
SSDEEP 49152:Qoa1taC070dyR3I2t7QyW2RguX8Jzt2kLWd:Qoa1taC0nNQU2W8JfLG
TLSH
T1C4952264F7A5C2B5D0810972A061C3E6EC7E3E7C57455C877FCC1B6E2AA4AC06A71B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5968	E70F.tmp

Executes dropped EXE 1 IoCs

pid	Process
5968	E70F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_314f695df997c006de71558fd8bb49a2_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E70F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 5968	5888	2026-07-06_314f695df997c006de71558fd8bb49a2_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_314f695df997c006de71558fd8bb49a2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_314f695df997c006de71558fd8bb49a2_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Users\Admin\AppData\Local\Temp\E70F.tmp
  "C:\Users\Admin\AppData\Local\Temp\E70F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_314f695df997c006de71558fd8bb49a2_amadey_elex_smoke-loader.exe 9F025E52F37484BF89407B532137F131F4465D07CEC4216CB29DA0133A63AA02A0AC61FB51DF9B94B0FF7024E241214E11F6230714139AB4E647A73A79F484D5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E70F.tmp

Path C:\Users\Admin\AppData\Local\Temp\E70F.tmp
Size 1.9MB
SHA256 8f34770712c5981cad653cb20c99e7c7990bcc02247289abe22b774b2fe2a13c
MD5 2bb073cbe9d50b2e4e449ac6d7634b33
SHA1 b2e808b8a2579c3d2677fd9a14d5abf0542f88cc
SHA512 5abc92a0b106c03d9f5b38f8535bdbb94cac4191b83ecb45fd4db54d7def7fba8b280537692e7ed239f7a72099d9faa4eeed3b989d1b3976469a3c841d5e0d11
SSDEEP 49152:Qoa1taC070dGxY4mH5iKVR/bwObL2d6/EaNc:Qoa1taC0jxYjHFVBIhaNc
TLSH
T109952251F7D1C2B1C8850671F1A2C6E39D683DBD96428C837BC81E6F29A0FC4A672B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5888-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5968-6-0x0000000000400000-0x00000000005E6000-memory.dmp