7ff9bed04e32a86a010c53a0efaa6afd38d46a9e3527476254c4547f1f1f4233

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 14:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_eefa3d24fc323f13f9bec52874d40900_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260714-rqd2vaev5p
SHA256 7ff9bed04e32a86a010c53a0efaa6afd38d46a9e3527476254c4547f1f1f4233
MD5 eefa3d24fc323f13f9bec52874d40900
SHA1 91e7dba2d6933e0e44ec121ec430385202f423b0
SHA512 a8213659afd14e6c3b79e73c2d62c107bb86c47101d2486cbc2174cb590dc731c5c0e9ccceacfec4e39e25aceb329bd8fd73a06c7bcf7789fd600c4ef54ea808
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dT0uLaJVQn/LQ/Ya9+0HDunOT47n0FVWPoo4V:Qoa1taC070dAPQL1GZ47n4VzWs1hp
TLSH
T1C3952311F391C2F1C0810671A092C3F2D8A93D7D96869C837FCD1B6F6AA4EC16A75B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3800	141B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3800	141B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	141B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_eefa3d24fc323f13f9bec52874d40900_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3800	4548	2026-07-14_eefa3d24fc323f13f9bec52874d40900_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_eefa3d24fc323f13f9bec52874d40900_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_eefa3d24fc323f13f9bec52874d40900_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\141B.tmp
  "C:\Users\Admin\AppData\Local\Temp\141B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_eefa3d24fc323f13f9bec52874d40900_amadey_elex_smoke-loader.exe F65F35DFEF04F34BCF43C17B3219227F5A6A9462039B7C5A6031ABD6DE150B83D995100C5D53EED5786651F251D1ACD362F2C334EB6A9AE5C0A603A4B3DCBA78
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

141B.tmp

Path C:\Users\Admin\AppData\Local\Temp\141B.tmp
Size 1.9MB
SHA256 96ba5985183e55e8dd6b4d2626f596d4cd1e97fbbff55e878c85d905fc81d76b
MD5 5fd34b807e7bc4b85a346b89d678b4a8
SHA1 c605dc207266caeb548db41833c89472a6fb2d55
SHA512 6a732abf9c2d4ab6e23a418cbe3d01d0c9e98a5d07433a513bb3d703a49b99e2a21d6a61f6e6b445e1cf61c5d9efd6f2be9e09c439c0825110f230ca200c8463
SSDEEP 49152:Qoa1taC070d0Pf2XayaDHXk/b90xUm6t4+rqE:Qoa1taC0WuU/m2h4cF
TLSH
T140952260E7A5C2F1C48609B1D592C3E6AC757D7D87858C837BCD1A7F1E90EC1AA21B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3800-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4548-0-0x0000000000400000-0x00000000005E6000-memory.dmp