8cc9db3582a9b868e6634b677005c7df3349f3d26405691929299656bed1f71f

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260715-e3d66aev2y
SHA256 8cc9db3582a9b868e6634b677005c7df3349f3d26405691929299656bed1f71f
MD5 aa56d615b24089f96b3baec688b6b315
SHA1 00ee82221a83a3fa02618d61996491576271d410
SHA512 1bb0bccb7d31cb0e3ad308cd7420085dd71fd96fe4bce479e697e1a2f3b1e59e775a7f23b008bca389bb86555badd5510f1726afa663d9ab566ee641e916be36
SSDEEP 49152:Qoa1taC070dQ71pnDhSM9e3R5UZ9w5NYZEfcIqF:Qoa1taC0FDoMCJN9cIqF
TLSH
T13A9523A0F795C1F5C4820672A191C3E2DC6A3D7D86429D83BBCC2A7F2DA4EC05A36757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1452	58D4.tmp

Executes dropped EXE 1 IoCs

pid	Process
1452	58D4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58D4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1452	3388	2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\58D4.tmp
  "C:\Users\Admin\AppData\Local\Temp\58D4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe 7D5D04C51160967BFC3127238B2AC354040E716DE64B76A472046280657A0EEE90B3E176B12027430DFD4AD56F80FEE1F5C2C497DF47EE865D89B4A66F2E4358
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\58D4.tmp
Size 1.9MB
SHA256 02b2510d84f70ff1cf8784c4b72abaf2092580c05e7d8cfb7b218a6619c1a962
MD5 13927117c6fb1a3eb2b593a9f2f822ae
SHA1 0528f625290c0b84e5d78c911e500be5b892fbe2
SHA512 1276cecc8f34c4f978ccacc586f1291f3e136492b3ccb02bf0edc7de57abb604c0149a21ab9fc7d3e6ff0f0fedd5970568499f6781457bf0e98ce8349ff4e1aa
SSDEEP 49152:Qoa1taC070dZ4teHkUkClEyYleA1wZObBNiz8cT:Qoa1taC03XU1+yYF12IBN6R
TLSH
T163952350F7D4D1B2C4810670A191C7E398297EB986829D83BFCC5B3F1D95EC46A72B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1452-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3388-0-0x0000000000400000-0x00000000005E6000-memory.dmp