d803ef749afb32c0ef39333e83ffbc42e78e2e8f9a8817a6d8efa568cd4a9d15

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260714-w8l8dsbs3r
SHA256 d803ef749afb32c0ef39333e83ffbc42e78e2e8f9a8817a6d8efa568cd4a9d15
MD5 be22486784dc33805ef6c9de3da1139b
SHA1 201352c4a17bac794e03cb611bc1f9c6592d40f5
SHA512 89e76f723a0b34d309a8c74293b088f2a61ae4ccbe30966049fb4f739eddb997399e7320b533ce9a5b0d6eb7d6e827f6d0a6f14414dda003e02357507a3681ad
SSDEEP 49152:Qoa1taC070d/DHlK2DHWwQaj+8KTK5hof8p2PHQRkQ5WOuw:Qoa1taC0sD0pp84q2UpTRx4Ouw
TLSH
T169952260E7D5C3B6C4810671F562C7E6D8786EBC52058C832BDE1B7E2E50EC06B62B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2208	136F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2208	136F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	136F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2208	1268	2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\136F.tmp
  "C:\Users\Admin\AppData\Local\Temp\136F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe 6B8C01B3E22B9A14805541806404DD9DAAC8BE119B9484B0CA55F236DAE19675E939C3D728A7146ABE4A4FA347F9482936EFF2BA47ED97C6CF60882446829041
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

136F.tmp

Path C:\Users\Admin\AppData\Local\Temp\136F.tmp
Size 1.9MB
SHA256 574068b3ec7c47914b06ac438ea3bd3106534cb1b58b727db4a99709eab2823a
MD5 3e2fa2ff946edae2af66dabf3b93ee39
SHA1 a5428fe5bd8e0572e1799aa50cbfcb4f8b0f05a3
SHA512 4f0113b230f832316224935cd5f322c662ed23a5fdc86f3ec1f9a6684a855f2fc499d75fef7cffd05b9de7e562e418e6d9147b2d7596df0aaacb084e83f1a068
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dg74NzkWmdHbqZK46VJmro+u2ZHSawUQa140x:Qoa1taC070dzNwWFcdIcVP13US0p
TLSH
T172952311FB95C2B1C4820A31A692C3F2DC3A3E7957858DC37FDC1A6E29A4EC52972717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2208-6-0x0000000000400000-0x00000000005E6000-memory.dmp