d1fef3c3c72979fd5448d861af617a2f2307b0ab200ab8a1199645c1db8ea594

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 13:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_83c22985dc3489056a9ac8eb0190a240_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260711-p85leabs5k
SHA256 d1fef3c3c72979fd5448d861af617a2f2307b0ab200ab8a1199645c1db8ea594
MD5 83c22985dc3489056a9ac8eb0190a240
SHA1 65379bd20277a3b1d0becdc67234b7c2a92919f1
SHA512 eb7bb2c5016c88a92421f16ce14087a27bbf19a335cb81ed093456f260abf7a3f2b9b549d87bb5628810f9926f24196d45a9c127a4c228d9f115ea7ca67189a3
SSDEEP 49152:eoa1taC070d3pLLRY1Gd2gloHoOEOsZkt36MmvCoNGJLXIbt:eoa1taC0U1RYU/l6DSZktqMmnNEr6
TLSH
T1CE952310FBD5C2B6C0420A30E562C7E6D8693E7D5B459D83BBCD1B3F2DA0A809E71A57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3360	D27E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3360	D27E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_83c22985dc3489056a9ac8eb0190a240_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D27E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3360	4772	2026-07-11_83c22985dc3489056a9ac8eb0190a240_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_83c22985dc3489056a9ac8eb0190a240_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_83c22985dc3489056a9ac8eb0190a240_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\D27E.tmp
  "C:\Users\Admin\AppData\Local\Temp\D27E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-11_83c22985dc3489056a9ac8eb0190a240_amadey_elex_smoke-loader.exe 42AB3C735469B4E020A2FCFF168D0F8DEF4A57405A8EB47C31B65160C6A12D92ED0F230CCD480DB307D29F091F681318DDD641B3FDA3146735C4D411D0347BF4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D27E.tmp

Path C:\Users\Admin\AppData\Local\Temp\D27E.tmp
Size 1.9MB
SHA256 7ffb1011b5aa5c945a09cba337caafc5b3b022c0a3c67e282c1320a3c8f0bdb3
MD5 3fa6d7d49015f179340e537006baea17
SHA1 87e69e297191422690d967ad6df1e0ca4378023f
SHA512 564d029ae5984eb91d43f8bbb4fc79ef3d54f8b42a3d4ecdf99d963712a7a8d6ec45a4a90f6b05d0405af8103ce3bb021a73f33e33ce09533f6647f1798a9d5e
SSDEEP 49152:eoa1taC070dJNHYYSqiOJ23TeEK93YRr/wAKi:eoa1taC0WN2OJ23Te5gr/w6
TLSH
T197952351F795C1B2D0811AB0E1A3C7A298753E7D5B41CC837FCC1B6F29A4EC0AA65B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3360-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4772-0-0x0000000000400000-0x00000000005E6000-memory.dmp