f7e78a8842101572d6d72dc28a6134eb672bc44aaf16af28e26f068ca61f0a06

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_03de1e4738e3b3bc08599156f2dfa6c0_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260714-v3eqpacv2y
SHA256 f7e78a8842101572d6d72dc28a6134eb672bc44aaf16af28e26f068ca61f0a06
MD5 03de1e4738e3b3bc08599156f2dfa6c0
SHA1 42dd42ccb53165988290f40463d2759a95318037
SHA512 68a08bd67a9ab858e8967bd803877a80ba8ee8bd94d59304f3f122231a00502d13eaf2c7fef4f9db5436d2d84b3699e48f894fd1550dd9c10c950b9bf959ced6
SSDEEP 49152:Goa1taC070U/dY2QXBC82JbQDZHSy7s5Y06:Goa1taC0hQXA8M8s5
TLSH
T150B50113F354D4E2C6D50634AD5182929726F871AA038A83798C535FCF637CA9F62F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4652	2282.tmp

Executes dropped EXE 1 IoCs

pid	Process
4652	2282.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_03de1e4738e3b3bc08599156f2dfa6c0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2282.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4652	4940	2026-07-14_03de1e4738e3b3bc08599156f2dfa6c0_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_03de1e4738e3b3bc08599156f2dfa6c0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_03de1e4738e3b3bc08599156f2dfa6c0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Users\Admin\AppData\Local\Temp\2282.tmp
  "C:\Users\Admin\AppData\Local\Temp\2282.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_03de1e4738e3b3bc08599156f2dfa6c0_amadey_elex_smoke-loader.exe C49EDE4940BD0D28C5034736BBF9DBD47A4AB635257589C1DB3E4368CEF500825C7CA38E6E483D19B0FE9EEBF0BB07C0711AC5ED25E3B7C6058374348485362D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2282.tmp

Path C:\Users\Admin\AppData\Local\Temp\2282.tmp
Size 2.2MB
SHA256 1baf293228a49b9541e137f4ca0d5dd4b8b67da0e6d39c1d48c20592804a7c43
MD5 aa5e8803e64b268a1d18541811996311
SHA1 ded6650d56ab6494e6e496ea7f6dce928dd966e5
SHA512 c1ac7a7294e82e6f94168cc30197e17a3e483eb3600bacb1fa35d137b105619d146cf78d881c21a09c012560cb63a100fd828ffdc9890602b72833de8b25c514
SSDEEP 49152:Goa1taC070UOe5QuJcoqxJR2PEH7EjV2bb3Z/t:Goa1taC0seLXqh2PC4j+t
TLSH
T1DBB50103F35594E1C6D50678AD6082929726FC71AE024A837E8C135ECF637CA9F67F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download