0ea216890737d5eeabedef39376ff23a9026479cc008b16b2d5d2df83b9bf044

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_502d45a53eb886f95be5ecdd22e9fea9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260707-efmvsaht2s
SHA256 0ea216890737d5eeabedef39376ff23a9026479cc008b16b2d5d2df83b9bf044
MD5 502d45a53eb886f95be5ecdd22e9fea9
SHA1 35cf9379ac9e3fa8e482da46393eea7e1a8db069
SHA512 45af6717992c7920a01a26573998a9c8ed1a6c370d546ef699c989e811527ae050125c54fb706c06a41b7e150dbd4a74a8d5d3faeef861b6cfcc2f3a7a0f0111
SSDEEP 49152:Qoa1taC070diRxcaZZGFVqp74V8juMwSHgYfP:Qoa1taC0ncqp7BDNpP
TLSH
T1C5952250F791C2F2C0820A70A251C7E3DC293E7D5B429D837BCD562F6DA4EC05AB6A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5624	4EF1.tmp

Executes dropped EXE 1 IoCs

pid	Process
5624	4EF1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_502d45a53eb886f95be5ecdd22e9fea9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4EF1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6096 wrote to memory of 5624	6096	2026-07-06_502d45a53eb886f95be5ecdd22e9fea9_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_502d45a53eb886f95be5ecdd22e9fea9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_502d45a53eb886f95be5ecdd22e9fea9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6096
- C:\Users\Admin\AppData\Local\Temp\4EF1.tmp
  "C:\Users\Admin\AppData\Local\Temp\4EF1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_502d45a53eb886f95be5ecdd22e9fea9_amadey_elex_smoke-loader.exe D2357D8B9DB0759AD656298F44D70BFD6C6503EBDEC60159514F2DD8EF332FFA18065E45F8E2D1888965E9544EA4D546CB02D0F0EF4E345B1096FE5870E4206E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4EF1.tmp

Path C:\Users\Admin\AppData\Local\Temp\4EF1.tmp
Size 1.9MB
SHA256 cf9e69c26baac4740c46ac4e72c8d5a54f5028110289c7f1747160b33d63c59d
MD5 07e853502c40e7e8075e415f95eb315b
SHA1 400ee31b3af84bb603613ea056ecc673f6f353de
SHA512 c84f51c952a9912e9ca281f7a208646202c6f9f158ee1df9af0bff438541f7786d0cc9ca50da76a1f59294c084eb591109f2347a35a95eb8fb8aae938a18c250
SSDEEP 49152:Qoa1taC070dSkoQnkMNUE6P83nKkqgx9lt+/hRLKKj:Qoa1taC0Bk/kMWE6P83nKokfLfj
TLSH
T190952260FB91C2B2C09106B1A6A1C3E398757D7C57468D47BFC41B6F2DA0BD06A76B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5624-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6096-0-0x0000000000400000-0x00000000005E6000-memory.dmp