27546a7536d4d162af479998f826d5b2d2c37ed0d603e1dc60e202d7f409596c

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260717-2pgfpaf16q
SHA256 27546a7536d4d162af479998f826d5b2d2c37ed0d603e1dc60e202d7f409596c
MD5 60531c04bbbf312d1a0c18ce52aa6bb6
SHA1 04341f2bd8d8211e35b95c11ca035cab45330ddc
SHA512 e5c2447b869ced691ff10c02b6595b115065349490d0cf1aac5ee7d84220a53d293e64823c43d74f0fcaa7c70eaa05935ea319e575b105c9b26759a43af4fb9b
SSDEEP 98304:5mSWOiIyUuviwQzRY3VE5dVLUjH5oxFbxx:5XyQzRGS5dVUjZEdx
TLSH
T1B8E52301BB95C271D08164F9615383EBD9743F7D4622AE873FCA2A1EDCB89E17674283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5748	A445.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A445.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 5748	3216	2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Users\Admin\AppData\Local\Temp\A445.tmp
  "C:\Users\Admin\AppData\Local\Temp\A445.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe FC869AF838AE367D90012F5CC5591FB6C9827B5982A57B8892FF32FF73BF08E1886C260514F46D7519E19EDEE54ED8CFE1180D18FBB968853D17DEEDE953F4BE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A445.tmp

Path C:\Users\Admin\AppData\Local\Temp\A445.tmp
Size 3.1MB
SHA256 9e1f4348bc0cef1f02fc218cd69f240f3c5590cba0282b17e3d6f0a09276885e
MD5 1ea3b7e7f59c1035e8782b7559d5e2b1
SHA1 3cef1b7e20aa4fc079d7790d7b93a12749d23c75
SHA512 f9a5c1f02148c44cb35c2077f66dad337674d6b17db4a899e16e9a6bb0be5ebac956022f7b4c3a77d21d7758649af774ee20440eb3056942146160d9653b64bf
SSDEEP 98304:5mSWOiIyUgwVAnGJsx+9SJhVLUjH5oxFbxx:5XfbJsx+8JhVUjZEdx
TLSH
T1A8E52340FB84C2B2E1C175F5A48387EAE4383F7D52659A4B2FCC1A2EEC949F17665603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-0-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5748-6-0x0000000000400000-0x000000000071F000-memory.dmp