773cacfbaac37f8a7d16f14719d7a4cbb0d769ccd5086cc86c39e73ab5a43458

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_1fd803456f403b90139d2f86940d00dc_amadey_elex_smoke-loader.exe
Size 2.3MB
Sample260717-kbvmqaa12s
SHA256 773cacfbaac37f8a7d16f14719d7a4cbb0d769ccd5086cc86c39e73ab5a43458
MD5 1fd803456f403b90139d2f86940d00dc
SHA1 149d0c9b5f44a915991bfdf2dc8a29f68d41b399
SHA512 871444ad5cf5405d6594d96ea373eaaaf4e034b4ee72b2709d48fca2c613b9a75cdd070327d9303ea87a4b3ad8ab29dc1205bfd9e7709662a6b9b70310b4fc51
SSDEEP 49152:yoa1taC070UsbyjNX/Ny1JBzoBDXWHgcqPJ:yoa1taC03jSAbeLqP
TLSH
T16CB5F053FB8186E5C65D4576AB504281932EF9326A0F6742798C031ECF9378B8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3076	40D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3076	40D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_1fd803456f403b90139d2f86940d00dc_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3076	4592	2026-07-17_1fd803456f403b90139d2f86940d00dc_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-17_1fd803456f403b90139d2f86940d00dc_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1fd803456f403b90139d2f86940d00dc_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\40D.tmp
  "C:\Users\Admin\AppData\Local\Temp\40D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_1fd803456f403b90139d2f86940d00dc_amadey_elex_smoke-loader.exe 292C893F7C8E9E8678C135073C64A5E66CB0D86376BA41F8AD2C3C859531F0CF6B15E718B6B6507926475CD3AE48B472B3C7D1A722F16FE4227526569B48FC89
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

40D.tmp

Path C:\Users\Admin\AppData\Local\Temp\40D.tmp
Size 2.3MB
SHA256 09c4877ae3086512aea2e826a0fdf9200057dc10ff10ca3f5eac83bfcca4e5ba
MD5 e0a8c166691140782be86fecec04c84f
SHA1 2cc2dce72b32aeae48c629fdd4a7fce599b37126
SHA512 0c964397cace66ac97bf286655ea62eda1c986b5b0b22543313c056aaac4400725285479fb4fa934de28b43a37ff86dd2dbbd080a9c8d0933b10b4293284032b
SSDEEP 49152:yoa1taC070UwNe/bcz35oq3Jcp1vdGOv+IfNC:yoa1taC0+Ne/bFq3GlJvNfN
TLSH
T1E4B5F053F79186E5C65D4536AB608281922EF5216B0F5B523A8C031ECF9378B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download