6132bc4e7fedca7ceaf59a1d2d39eb9702e9cd552ea39581dcc43e70c5e731b4

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_b4741e403578547ad913a83c19eebbbe_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260715-cmpa3shw8q
SHA256 6132bc4e7fedca7ceaf59a1d2d39eb9702e9cd552ea39581dcc43e70c5e731b4
MD5 b4741e403578547ad913a83c19eebbbe
SHA1 7046170acc1612498bcadbcc58fc16671565f71a
SHA512 f81fea71873f489441f3728dfa70bb47f49e51cd044426d98031c4dc4931eefa33cf6ae23e509c49ef3affe2f3dff22ae53a9c2e350067d528153bfd3f8065e3
SSDEEP 49152:Qoa1taC070dYrP4a1U2OCqh33lB9rgVbVJA:Qoa1taC0xyCc9eJA
TLSH
T1D3952252F795C2B2D0860671B561C7E6D8793D7C1A409D83BBC91F3F28A4EC4AA3274B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4876	1F56.tmp

Executes dropped EXE 1 IoCs

pid	Process
4876	1F56.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_b4741e403578547ad913a83c19eebbbe_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F56.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4876	4128	2026-07-15_b4741e403578547ad913a83c19eebbbe_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4741e403578547ad913a83c19eebbbe_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_b4741e403578547ad913a83c19eebbbe_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Users\Admin\AppData\Local\Temp\1F56.tmp
  "C:\Users\Admin\AppData\Local\Temp\1F56.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_b4741e403578547ad913a83c19eebbbe_amadey_elex_smoke-loader.exe 0B149DB2EF41537F5294511E0EEF53969E35D1C9211A19833BB7152E586FB1697D6EBBF24965719D64C06977C66589A30AD8C3E95FEBC02B58800F8F4846E7DC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F56.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F56.tmp
Size 1.9MB
SHA256 9e8144ce9318b673d3afb1b5098d4633e23618cf3de0f0d40d8b068dad0640ce
MD5 a5e0090aefcac2918499b796aa1ddd42
SHA1 c3a9b0744c79a6bb91c0f8fc12f024354a66dd6c
SHA512 3fd28a4ce6466d4114d6ef69e24589369fb77d98a7103553282019ea0aa28ab1aaf5b05b7d814cfec760ab64513290dd7a43ce72c6695faa5574e5d9f2173cb5
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dCVxQPw343E/LQotlAjSubBIVwOIw6iDaNA3C:Qoa1taC070dCVmPw34ILjAFFHw6iDdI
TLSH
T1C3952255F789C2F2C0814635A161C3E3AC693EBD57429C837FDC1B6E29A0EC06A72797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4128-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4876-6-0x0000000000400000-0x00000000005E6000-memory.dmp