b883fe3ecd55ac3b1afc4403e8a9ca0d704a94ee34f6b025db1065d545a8e5f3

Analysis

max time kernel
148s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_6427ff9930e07e3b049ab8570abcae36_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260716-b99pvsd151
SHA256 b883fe3ecd55ac3b1afc4403e8a9ca0d704a94ee34f6b025db1065d545a8e5f3
MD5 6427ff9930e07e3b049ab8570abcae36
SHA1 bc73f32e03e3b9bfddb354cf9ce6b26b0a35c8c2
SHA512 e42775b8e3be38438d92dbeee5ae24ce15e32792f6a1026addd2e05b414eba1a195fab1a27d8425481fead5469c97de2d39e1eb1f0bb7928598a156ff89f02ec
SSDEEP 49152:Qoa1taC070dXN09LaSbPSYmySpjyqb6oWUfDME4k:Qoa1taC0H7w7puqb6VUrF
TLSH
T18A952251F7A1C2B1C0D10671E292C3EA9CB53E3C97869C837BC91B3F2994EC05A66B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4588	404B.tmp

Executes dropped EXE 1 IoCs

pid	Process
4588	404B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_6427ff9930e07e3b049ab8570abcae36_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	404B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4588	3128	2026-07-15_6427ff9930e07e3b049ab8570abcae36_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_6427ff9930e07e3b049ab8570abcae36_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_6427ff9930e07e3b049ab8570abcae36_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\404B.tmp
  "C:\Users\Admin\AppData\Local\Temp\404B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_6427ff9930e07e3b049ab8570abcae36_amadey_elex_smoke-loader.exe 4833155A196FCE78E21B0573C9912CCF3209E051F073964004CC150B6CA394767BA626656AEB63BA5EE4F887E24A71F9407878D7CC0D6B7F0AF3D9AD9EC9160F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

404B.tmp

Path C:\Users\Admin\AppData\Local\Temp\404B.tmp
Size 1.9MB
SHA256 b417612ab9eafaf13b116fbff03ec6bfcdaa1305246544da9bc12c3c8118f084
MD5 fd2a378b350d0272c7b1a43d898008e1
SHA1 50d623e723bde1b7f705f2059741a5fd6f383b9f
SHA512 838e011aa059dbf94660540aab7707fee6b13962e05487f65b38ee4c6e15eaf881b1cb2325899d5f60f90891fb7ee9d110a7dd1de5e8cdb3b4de46ab20237e72
SSDEEP 49152:Qoa1taC070dFTHUbNDlXAxQHzRJQLv19KaiXqOWO:Qoa1taC00jUbNSxBLvXmfWO
TLSH
T1D8952314F791C2B2C0810672B5A1C3E6D8762DBC57848D877BC82B7F2894FC4AA7575B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3128-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4588-6-0x0000000000400000-0x00000000005E6000-memory.dmp