4f900968e1325a4ff8ae7d4115ed3ace49067e669d1fd5c52536707737ff746d

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_362a8ed504f793bbf12f8466e4db4393_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260715-dlfg8aaw2m
SHA256 4f900968e1325a4ff8ae7d4115ed3ace49067e669d1fd5c52536707737ff746d
MD5 362a8ed504f793bbf12f8466e4db4393
SHA1 f3f33ac1021a26e73763f315aff63e0a44e85f44
SHA512 2b72b6212e8e8cf4ffdd20ba80b5afcc354dccaadc40abd0f5de49b3c69d3d85c253f48467f7a34b3053fb876f07c3c0a0140fc3bd5a9a8727079728eaf1cbd8
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dP/gaEMYtdDzOe8L7Br8bRKNAsBGWbNHxLygr:Qoa1taC070dH0xueXKNLxRGgVNH
TLSH
T1B2952354FBA5D2B2C0911571A552C3E7D8BA3E7D97468C837FC81B2F29A0BC09A3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3420	E903.tmp

Executes dropped EXE 1 IoCs

pid	Process
3420	E903.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_362a8ed504f793bbf12f8466e4db4393_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E903.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 3420	1132	2026-07-15_362a8ed504f793bbf12f8466e4db4393_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_362a8ed504f793bbf12f8466e4db4393_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_362a8ed504f793bbf12f8466e4db4393_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\E903.tmp
  "C:\Users\Admin\AppData\Local\Temp\E903.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_362a8ed504f793bbf12f8466e4db4393_amadey_elex_smoke-loader.exe B34EB6E95107CB21FEFD1F7889175B2B34D3827DBD01D164916447778F4BFD69C3FEFAFB69F4072FE39D5BA08F4078011DF4BAF6DBF0777F3596DE8B2390BDB5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E903.tmp

Path C:\Users\Admin\AppData\Local\Temp\E903.tmp
Size 1.9MB
SHA256 f398c5cff9fce99bdf6b12c53ce8c611b77e51ce0c185a085312e4b213927e46
MD5 7c139171db8411b88d097aef192b7104
SHA1 fd3225036c26788dd7f3f59406480069df03c128
SHA512 306368bfcab7df59bab5ba4b0ca6bd19702952c96ae91d8a270d7b8cc42ea5bafbbebf8a71c9041fb7bfbce8ead54d44bf066ad24ce6cdfc5b1d1f63edfb129c
SSDEEP 49152:Qoa1taC070doVx6JK73WpqzMaNxwlPIyKl8KI1z+BUQtv:Qoa1taC07D73jBxyIjGgBUYv
TLSH
T147952360FAC5C2F1D0910532E292C3B698AA3D7D56464C837FCD2A6F7960FC01A76B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3420-6-0x0000000000400000-0x00000000005E6000-memory.dmp