325f7afea0da675c998718852f0e92cc0b115767fb57dacc4a919daf24e498b9

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_1bb12d7af3af6cc6a9c2f2f92f97a677_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260715-drtxssax6m
SHA256 325f7afea0da675c998718852f0e92cc0b115767fb57dacc4a919daf24e498b9
MD5 1bb12d7af3af6cc6a9c2f2f92f97a677
SHA1 5a05a88c5c556e1074ecf88057635d8e353c33b7
SHA512 1bb9086b71caa5ddf938ab2cf9907bb51fa12bfdc304f1c9cb3a6de7d53e5b456246b21a99b71fdcf923982e2a1a362ef1639e80d76e356627253225224c9d7e
SSDEEP 98304:Cmhd1UryeFMnwoOEEVwm4xIFwPKVVLUjH5oxFbx:Cle9Wwm4x2VVUjZEd
TLSH
T12E262351F740C272E08165F9A482839B9C743F389A659D8B7FCE1B2F9C68CF1A275253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2684	E039.tmp

Executes dropped EXE 1 IoCs

pid	Process
2684	E039.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_1bb12d7af3af6cc6a9c2f2f92f97a677_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E039.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2684	1948	2026-07-15_1bb12d7af3af6cc6a9c2f2f92f97a677_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_1bb12d7af3af6cc6a9c2f2f92f97a677_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_1bb12d7af3af6cc6a9c2f2f92f97a677_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\E039.tmp
  "C:\Users\Admin\AppData\Local\Temp\E039.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_1bb12d7af3af6cc6a9c2f2f92f97a677_amadey_elex_smoke-loader.exe 5BDDC452BD2EB7AA38D846A629DBFC39DD459FBB9D3E11E8833450A27C15CB9DB92FBDAD0587138B3EED6AD71A55805DBCA9E84F417A3D6C504B7C22F555BBF1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E039.tmp

Path C:\Users\Admin\AppData\Local\Temp\E039.tmp
Size 4.2MB
SHA256 457cc70f4979cc026aa3042937ff84c3734c22a287deb250f25656700b8bacf7
MD5 2acc24057d3961b848c563c580105c59
SHA1 df9ac5a6ba373b4a22315cfa2e85cd8a2d872337
SHA512 8233ab73b73f81111e0f0cd2ddf271052f39bc530fdb4b99c1f1b60fbe00a0a22d065451060ab4189728db2fb3f6cdfa0736cf4cf6ff3f239bb853129599f0b8
SSDEEP 49152:+vm2AC0d1XqrdryeJVKzXSOmgy1qzM+yq7s7Yl0UwLVT5kUvgJSgHT6ojkxFbxLn:Cmhd1Urye+zMgTM+y80nVLUjH5oxFbx
TLSH
T179262390BB55C1B2E18125F8308387D6D8343F3D16619E8B3FCE2A2FAC689E17675647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2684-6-0x0000000000400000-0x0000000000849000-memory.dmp