a7f650fe3e08638c115a18a391b0f08bee2aa382e6809028ad0b142ca5f52dc1

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_04384f27b7c06c77e949bd3913c09bd4_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260711-rbb9psct9m
SHA256 a7f650fe3e08638c115a18a391b0f08bee2aa382e6809028ad0b142ca5f52dc1
MD5 04384f27b7c06c77e949bd3913c09bd4
SHA1 19221e2bc076b82d9dc3311e5aeca80fd52645be
SHA512 9912c73c5dcce10bce327d3547499b6661824d55040ed204b040b664b878c8a9e60427ab4b5419b0dd2f4ad2db36d2729c6c40fa89d97cb2d874d62244db7f66
SSDEEP 98304:emhd1UryeH4V6HoaEQwGiFskT+VLUjH5oxFbxCVLUjH5oxFbx:eliIdEQFie2+VUjZEdCVUjZEd
TLSH
T19F262351B7D4C271C1C278F9A48383DBDA343F3D5566958B6FCB2A1EEC688E27278142
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2480	28CB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_04384f27b7c06c77e949bd3913c09bd4_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28CB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5580 wrote to memory of 2480	5580	2026-07-11_04384f27b7c06c77e949bd3913c09bd4_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_04384f27b7c06c77e949bd3913c09bd4_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_04384f27b7c06c77e949bd3913c09bd4_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Users\Admin\AppData\Local\Temp\28CB.tmp
  "C:\Users\Admin\AppData\Local\Temp\28CB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-11_04384f27b7c06c77e949bd3913c09bd4_amadey_elex_smoke-loader.exe A7D51827891FF99B09DF0A2BC3817ABC591BD1D44ADD7E07BC43D9FD3BBBF6FF28404F313B8A30D5A801CAB186C2D43F6CFA1A77CF965AB1AE449ECDE9F1D7C8
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

28CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\28CB.tmp
Size 4.2MB
SHA256 90eb53a1bbce6e2410c60a9b5388ea303486aa0ec9cf88fc4d282990507c9684
MD5 03d1591b128bfd16f1517eda197bb182
SHA1 b82ce2219994d1c3b7b43f43f9e7a2f25c8d6cad
SHA512 b6a4df04b0e1377cf0109cc4ca0821e70a01218213ad06f85b9f1323d9f4d8633218a71186ce19e7c17a1111bbc238de6569f575101bc51f6f1a080d60cba26a
SSDEEP 98304:emhd1Urye2AF4PdKBVLUjH5oxFbxCVLUjH5oxFbx:elWA0OVUjZEdCVUjZEd
TLSH
T19F262340B7D4C361D18634F9A48347DAD9343F7D9675998F2FCA2A1EEC688E272B4243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5580-0-0x0000000000400000-0x0000000000849000-memory.dmp