6903b26322386d2f04e766c2cfab876c936ad79844cdf02f6ab8b0b503529c35

Analysis

max time kernel
150s
max time network
96s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_22717c9e4dc7a16eb14d55ed9e629178_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260713-yfad8shw21
SHA256 6903b26322386d2f04e766c2cfab876c936ad79844cdf02f6ab8b0b503529c35
MD5 22717c9e4dc7a16eb14d55ed9e629178
SHA1 2a3272d0212987563b8337a0e073d2bd61922188
SHA512 a7c982c0d3d9c0aa7d1c89a6c0ddea2f12c49c7e30e2da5abf4ac4b24146dad3bb37ba18b097cd1b1273976888b137ea06a2a74d5c735e21059857f321e4f88f
SSDEEP 49152:boa1taC070Un0wsYLz67VB4MtYpGxzycU:boa1taC06wfqDtYszbU
TLSH
T1E1952314F7D5C1B2C0800671A592C7A2DC653E399B824C87BFCD1F3F1AA4EC16A66B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3280	4D3C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3280	4D3C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_22717c9e4dc7a16eb14d55ed9e629178_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4D3C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5612 wrote to memory of 3280	5612	2026-07-13_22717c9e4dc7a16eb14d55ed9e629178_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-13_22717c9e4dc7a16eb14d55ed9e629178_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_22717c9e4dc7a16eb14d55ed9e629178_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5612
- C:\Users\Admin\AppData\Local\Temp\4D3C.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D3C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-13_22717c9e4dc7a16eb14d55ed9e629178_amadey_elex_smoke-loader.exe 6184667DB29FCDAAD485C7F96273B88906125EE03F7554600435D48C34D3712CC2AE8E8AD8DED3979621FEA26EE09C30F6C8A142180CAB31568EF75683394B4A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4D3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\4D3C.tmp
Size 1.9MB
SHA256 7ac98d8a96f4873cca50dbd3429edd8eacd7bccbdd1e86c42483e125a8fd267d
MD5 ec4f528ec49f3fdc17aacd68ee5381e8
SHA1 54d72a99ea24dfc98f0fed061619f88c2f1f6d3c
SHA512 66b69fd3c9409f71d8f22a13bf59df84b058c0e2ddd6c783fb3a55e50b4cfb7b60cbffd943a45560cef0c38382fc0458907acc91d4a9097e198554ee14662f3f
SSDEEP 24576:S2oo60HPdt+1CRiY2eOBvcj3u10U/x/obCWzo4H5K1B0u6pfwpdktzr6AapI2Flz:boa1taC070U2bCWkDzhGKJ3sDP8
TLSH
T11A952362E7D4C2B1C0810971A552C3F3DC7A3EBD5B409D437FDC2A6F2884ED4A662A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5612-0-0x0000000000400000-0x00000000005EB000-memory.dmp