d4d26eaa841e28f214c0bf3a61e2dd3a0c04062c6a475f8d9e5a85800c4853d8

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_1442e463b7d61998a90d61470493d230_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260707-fx585afv6p
SHA256 d4d26eaa841e28f214c0bf3a61e2dd3a0c04062c6a475f8d9e5a85800c4853d8
MD5 1442e463b7d61998a90d61470493d230
SHA1 259885d5e074441661d6834a66e2fff8e0d34e3f
SHA512 fc67d07f0a413d90d32bf1c854e3ec49a764ec7e2fef688681fc56b72a504ca7fbb15e11d4089a9888a506f24bd02f83992a03d6323dc34d7bd1be981ad2069d
SSDEEP 49152:toa1taC070UVp2EXD8nF0xJMRhJdrz8Lpv:toa1taC0fpz8nF0xWtz
TLSH
T1DA952226F391D2B2C0C11631E592C7E6D8293DBC56129C833FCD1ABE2D64EC0AA76757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4244	9021.tmp

Executes dropped EXE 1 IoCs

pid	Process
4244	9021.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_1442e463b7d61998a90d61470493d230_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9021.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 4244	4752	2026-07-06_1442e463b7d61998a90d61470493d230_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-06_1442e463b7d61998a90d61470493d230_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_1442e463b7d61998a90d61470493d230_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Users\Admin\AppData\Local\Temp\9021.tmp
  "C:\Users\Admin\AppData\Local\Temp\9021.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_1442e463b7d61998a90d61470493d230_amadey_elex_smoke-loader.exe 9C81DE5AC91C996FC10B330758AA5BA6CD2389134FBCD2D5BE81D038E11A984181E5C69DDD1EA87B7A858392238DAC8025DF1DBC97855644F2BE540A09BD57F9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9021.tmp

Path C:\Users\Admin\AppData\Local\Temp\9021.tmp
Size 1.9MB
SHA256 78777d1681f678b1ec3af545f252c49d073ff702111bd1be3e9822118e4cd807
MD5 537dce55b815cae39f2629b21683f51e
SHA1 cfa6eba3f0bdb24f6165c4613692dd0340ef152f
SHA512 c8917b1c407b52ab8347ed94756c54b4abdee7c60c7b1affdb2f68a0326e5991618b359b9cd4bba36260c85500a7a7eb04c0214eab2a9173a08db1ab4ee475d3
SSDEEP 24576:I2oo60HPdt+1CRiY2eOBvcj3u10U2RPCC06NMW0b5kRc88hnSDM6638gZ5FxyVBi:toa1taC070Ue6IKPyRcZSDMtkwrQKcO
TLSH
T12A952311F781C2F2C48646B1A551C3A2D8BA3E7C67858C877FD91B3E2960FC0AA7571B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4244-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4752-0-0x0000000000400000-0x00000000005E6000-memory.dmp