78045995babd5369355575f04c6de4b7c47969beaa5d56f364e685905d2a9d80

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_fbbd4453fd4e307f176b01ed85f3c974_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260714-pjadzaev8w
SHA256 78045995babd5369355575f04c6de4b7c47969beaa5d56f364e685905d2a9d80
MD5 fbbd4453fd4e307f176b01ed85f3c974
SHA1 4c622eeb90428e7f18da516e32fecf019b9d8a61
SHA512 88cd3159d600567cb0b1e10c72de52c6b69bf5accf12fe4b5bff8237bb6b761beef90b0fef84de1e903ae6f444172b72d2ee6233751d4b8c3c70a321d75c9167
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dJC10xYbwFlhTMc+PG6nZV503Xot1KDHWay5m:Qoa1taC070dJC10xYbilheG6NO9yns0Q
TLSH
T166952360F7D5C1B2C0810630A4A2CBF29CB57E3D46459D877BDC1B7E29A4EC06A36B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1912	49E0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1912	49E0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49E0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_fbbd4453fd4e307f176b01ed85f3c974_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 1912	2756	2026-07-14_fbbd4453fd4e307f176b01ed85f3c974_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_fbbd4453fd4e307f176b01ed85f3c974_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_fbbd4453fd4e307f176b01ed85f3c974_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\49E0.tmp
  "C:\Users\Admin\AppData\Local\Temp\49E0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_fbbd4453fd4e307f176b01ed85f3c974_amadey_elex_smoke-loader.exe 3012D30B525AF4A7C4F30177CEA9214268759C8E006D2BB563FC8CA89F635BB1C707CF499D3CBFA741669C0E2CEC0EA54E4B24566F55B807986D0E175B610CA4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

49E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\49E0.tmp
Size 1.9MB
SHA256 3b94c5819afd4aa3f0842aad01407cd225626476539518c94a3fb664c28aa02b
MD5 4740a7ca1a78060dbfd7897684d49ec4
SHA1 6bb721c4421ab129bcd92386271a0835bdd42af6
SHA512 3a9ce9e38c22c863fe50963838e7e34b0e51d385a3bf8fc7bacfccb5c63dab52f8504339a8204a08276c9d76f3e428eb5f04f034525ec98aea089191d4d54d0c
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dJVUzCja4CPPLsd0UcvYzFdyDqErdxYlwHIy0:Qoa1taC070dLUzCjZCLbvAzyLHHIjbV
TLSH
T1A6952265F7D1C2B2C0811A31E592C3E688793E7D5645CC87BBC91B3F2960EC06A3676B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1912-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2756-0-0x0000000000400000-0x00000000005E6000-memory.dmp