34b8fbe748f07c8dda0e799d6128dd07baf3bab8492a40febef2c4197c49890e

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_513f151d21d8c36abc200bbf3380c179_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260708-2eav6aaz5t
SHA256 34b8fbe748f07c8dda0e799d6128dd07baf3bab8492a40febef2c4197c49890e
MD5 513f151d21d8c36abc200bbf3380c179
SHA1 c1647ae8ece7e96618ec40be0f10f0eb2a707090
SHA512 0fcae814270dd9a0f66414086f64ace652afb5487dc6f62105bdb75263eb5ed6bbbfcf77263b8beabdc2856004558f8e65d80fa69f14bb1f4fbe39319571f92f
SSDEEP 98304:emhd1UryesBWRygVLUjH5oxFbxCVLUjH5oxFbx:elupgVUjZEdCVUjZEd
TLSH
T157262340B7D0C262D1C275F9508343DEC6783F7D4676998B7FCA2A2EEC699E27274242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4464	5809.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_513f151d21d8c36abc200bbf3380c179_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5809.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4464	4412	2026-07-08_513f151d21d8c36abc200bbf3380c179_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-08_513f151d21d8c36abc200bbf3380c179_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_513f151d21d8c36abc200bbf3380c179_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Users\Admin\AppData\Local\Temp\5809.tmp
  "C:\Users\Admin\AppData\Local\Temp\5809.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-08_513f151d21d8c36abc200bbf3380c179_amadey_elex_smoke-loader.exe FEE4FFD64E5FA5522D072E0723CFF5CA6D9FC820E88B177646093B13A6C7CFF4B96D8E7558D9B09046C5BE9069FF1E65AF056FB209862C864C9D0824EDB0F4FC
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5809.tmp

Path C:\Users\Admin\AppData\Local\Temp\5809.tmp
Size 4.2MB
SHA256 b22eea8e1b4814f0403dc9c6ddce8957092f77658819108c192f0f0165e50f84
MD5 8243a964952dbf01e6972bcd29cdc457
SHA1 7cdde1dade024dc3ca25a4376d6dae9cb0d67716
SHA512 7bea707f3e18feebdc29992b936a93e793bde3668d59c55c8c240fb9ef7fa36e4c36fc91be89e4f1f62e1b505ad1d6b43e6967fdf55a1b262f3e6d7dfe721f3a
SSDEEP 98304:emhd1UryeQbMITIedVLUjH5oxFbxCVLUjH5oxFbx:elwb3dVUjZEdCVUjZEd
TLSH
T100262381B794C371D18234F9608343DBC9743F7D4679A94B6FCE1A2DECA98E27678242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4412-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4464-6-0x0000000000400000-0x0000000000849000-memory.dmp