67ad7559c75cb07fa6e4950cab6d8156b819dfda76d4a8e0b0348d01333493b4

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4721b1cc20f0eb8da974c46d7273f9a5_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260717-227teagv7l
SHA256 67ad7559c75cb07fa6e4950cab6d8156b819dfda76d4a8e0b0348d01333493b4
MD5 4721b1cc20f0eb8da974c46d7273f9a5
SHA1 07c61204cb90b9cd99bb9b709f2048400631ab3c
SHA512 9579eafa91fba0d4c91051b42aef8cc9fbc7b0dd2c8d25c99f35d8564f68772554e3783b59023db4a4069514f6deb40a60cd54d45b7729c3b76da3288791a6c7
SSDEEP 49152:Fvm22OdWOXqrbIyUJGkI+GpOyLdIfdIxRuqPapVc2wLVT5kUvgJSgHT6ojkxFbxx:5mSWOiIyUjIRL7k+agVLUjH5oxFbxx
TLSH
T19DE52341F7C4C272C082A1FA648383D7D9757F3E8665994B2FCE2B1E9C789E16279243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4852	BC80.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_4721b1cc20f0eb8da974c46d7273f9a5_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BC80.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 4852	2608	2026-07-17_4721b1cc20f0eb8da974c46d7273f9a5_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4721b1cc20f0eb8da974c46d7273f9a5_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4721b1cc20f0eb8da974c46d7273f9a5_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\BC80.tmp
  "C:\Users\Admin\AppData\Local\Temp\BC80.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_4721b1cc20f0eb8da974c46d7273f9a5_amadey_elex_smoke-loader.exe D6027458A4F7CFD0B39D02FB58F10B01C90F2CE71F835953FB1E0DAB6950CF3FFA2F83EF69F2E6AFB50FCBF9D7928FFE093C514AF32B85E998D2168A360BD48C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BC80.tmp

Path C:\Users\Admin\AppData\Local\Temp\BC80.tmp
Size 3.1MB
SHA256 eac0e64af93bd5606ec7881c96821b76e3c7c1463c8eec0fb958bad81d1f2ad9
MD5 2a5157d21e629024b6d52253a81a4dd6
SHA1 13cfa4ab2ef8c11e24c7fb0a487c0fbb461911b4
SHA512 ed8b16b11cf6cf085f2a4197590bf919c084ebd397dd9650de79aa7af49265853f87799d5f468b595856b6eb4763e583694d6b245d5763c27c5f6862f3a2baff
SSDEEP 98304:5mSWOiIyU2Ezg7eW1RUhBLajWICRHHPVLUjH5oxFbxx:5X8l7equLajWICRHvVUjZEdx
TLSH
T1D9E52342FB94C272D08225F9619387D7D8783FBC592598873FCD1A2FACA49F52671243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2608-0-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/4852-6-0x0000000000400000-0x000000000071F000-memory.dmp