43d75fd1eea3bbd6a01408dd44c14e0b4da3605ea457850442a8fd067d4ea323

Analysis

max time kernel
148s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_72c588eef0cbbafdb77103945db09534_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260714-xj31aaes41
SHA256 43d75fd1eea3bbd6a01408dd44c14e0b4da3605ea457850442a8fd067d4ea323
MD5 72c588eef0cbbafdb77103945db09534
SHA1 81fe9ab2ac16dd6aaacad26cab50ec8882bbe3c7
SHA512 681a9cbb1273004e6bb92b64317a40a49a751bf153113850f4826c1ef04d3fc914b4de8aed99ccf4bcbfbb8991183ffa440c2787bc5289a823ec4bd6def0bfdb
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d2jRi+Msm9Y7AVF0asI6A5nWTyLt3qe2TPNGQ:Qoa1taC070d2j0JvgAsIoO0RGafDyM
TLSH
T124952218F7D191B2C0910571A5A2C3E6DCA93E7D5B418D837FCC1B3E78A0EC4A676A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1216	477F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1216	477F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_72c588eef0cbbafdb77103945db09534_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	477F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1216	1500	2026-07-14_72c588eef0cbbafdb77103945db09534_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_72c588eef0cbbafdb77103945db09534_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_72c588eef0cbbafdb77103945db09534_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\477F.tmp
  "C:\Users\Admin\AppData\Local\Temp\477F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_72c588eef0cbbafdb77103945db09534_amadey_elex_smoke-loader.exe 3E2BEDF03484E418EA56BA561A099D963DA1E4B26864E28E66B54458BD90BF654F13CF524F3461C6C2065BAC3005A2F441ED93DB0D12DE897CE31A34ABC92751
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

477F.tmp

Path C:\Users\Admin\AppData\Local\Temp\477F.tmp
Size 1.9MB
SHA256 7860fc120fbacf1cdac9a4c8c470cbd90e4905a37141ab0e36f7e2ff238e30e2
MD5 f16d8047aebc581310a4c426efd5ff08
SHA1 a798f8d22463d639184d3771ac8d509089f0c9d2
SHA512 3fa0838a3381e0332bd9e56a16d38355bccffcbcb51d321da4cce8626eb5109e87380c72ef1ef6972d5f099400b4732aa0cf7217bfe4f9c76cbae3787001c144
SSDEEP 49152:Qoa1taC070dYOBHgV4MRhIMh1MsKA1LclZA:Qoa1taC08q4MRhIMhy0ATA
TLSH
T160952260F7E4C1B6D4811671A1A2C3E6D8793E7896458D837FC90E3F2AA0FC46A71B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/1500-0-0x0000000000400000-0x00000000005E6000-memory.dmp