c74a2f793e0d6e36601aed5361a9c6cfea292cfc66da5161db6fe38871be5d4c

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_9030c7ce42024f9359e6390bb344f93f_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260714-bcdadsbx9n
SHA256 c74a2f793e0d6e36601aed5361a9c6cfea292cfc66da5161db6fe38871be5d4c
MD5 9030c7ce42024f9359e6390bb344f93f
SHA1 ef40b5e4ed7990138ef16712e22467252f288a5f
SHA512 fa9338ab3a4a9512b71475ecaf08871f886690072a6407b066e3b60613f53405cfdda1391f2e811eaf7ed5df1d5d87bfccff70a2fbd4581e5afbdbbb8716b0fa
SSDEEP 49152:Joa1tHC070U5N5oPqQDYVUEsU5U85kDXd9qp:Joa1tHC0EPjDLEhUZ
TLSH
T1EB951258F79482B6D041C97AD6A2CB5BD473383A53004DCF6B958F3A1E27AC67331B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3380	54BD.tmp

Executes dropped EXE 1 IoCs

pid	Process
3380	54BD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_9030c7ce42024f9359e6390bb344f93f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54BD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3380	2284	2026-07-13_9030c7ce42024f9359e6390bb344f93f_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-13_9030c7ce42024f9359e6390bb344f93f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_9030c7ce42024f9359e6390bb344f93f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\54BD.tmp
  "C:\Users\Admin\AppData\Local\Temp\54BD.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-13_9030c7ce42024f9359e6390bb344f93f_amadey_elex_smoke-loader.exe A45925D599320719900A55748FC8F4BD61AC893EA913FAA6EC1C15270BB1D4C11EFFFB05A0E22943193C6E15E58A401089C8C7241C7C4C625A6B0FDA488AB923
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

54BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\54BD.tmp
Size 2.0MB
SHA256 5779d051b0959daec643f74ce4f27efc14d5c23b1c43687eef590705f5bf1393
MD5 901a3fc1054b115cf9be2a39a65a2398
SHA1 6c2bfd2dcd709e9ee771e8e3c71edf2bf8933f0f
SHA512 f36352c4105ed41c7d9d5d821b81f7cd3710b04832e26f5b188be0c3de6894d7273c34579b51cd015e95ecd4b541a5ea3c7f278e1bca75b772bc8aeacb49de60
SSDEEP 24576:82oo60HPdtR1CRiY2eOBvcj3u10UNtAnKXJgdnGUsQWocelVxOteOfsCpJSaGjlE:Joa1tHC070UDA44nwQWzUSRvoamXyp
TLSH
T1AD951218F75481B2C051D9BAEA62CB57D477383A63004DCB13D18F6B2E27AC5B735B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2284-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3380-6-0x0000000000400000-0x00000000005E6000-memory.dmp