cca32a69493eeb6a10f34f02d2632548e620e2531799e8d646ff82bc632dfba8

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260717-tts2aaa14x
SHA256 cca32a69493eeb6a10f34f02d2632548e620e2531799e8d646ff82bc632dfba8
MD5 f8ed649aa879de82083052785763de0e
SHA1 14a94c35c4d05d0d799f0e5bd357759e2396e1c6
SHA512 d09ceaab66ccd182635295b1223a6fcd7fe76c4ae21714c4db008399ccc9ad498f4b1bc7b09b785176ba3da32d251b3807e18c7d44205cbf0733d5b8d1358a98
SSDEEP 98304:emhd1UryeqEjcvvJz4AH0p9n9VLUjH5oxFbxCVLUjH5oxFbx:elKLvvJnUp19VUjZEdCVUjZEd
TLSH
T16D262340B795C261D1C238FD648343DAC6783F6E5175A94B6FCE2A2EEC684E27279343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4580	3109.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3109.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4580	1960	2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\3109.tmp
  "C:\Users\Admin\AppData\Local\Temp\3109.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe 96E07A3FACCC740D1AF85C63ADEE23B72A444DA677E51ECB160A94FB9D375E139844A4F682159CE722FB203F7B4051019063216FD1795CE7404F9999E752A239
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3109.tmp

Path C:\Users\Admin\AppData\Local\Temp\3109.tmp
Size 4.2MB
SHA256 6f5b71bc4f7d3339984336128749d18777970abb3e464d32331061893ea0b34e
MD5 3de9f0b4f88b2b42b608da6ba2e585e1
SHA1 3ea86a63d883abf15741d5f4e77a6cad6bb580a4
SHA512 8b598acb590dbc7bf25c4c2ab2c537e670380c5587b042f140112cab7dabd0ceb31141e01538bac3cb39580918c98aa3acba2e8b6a8e6ecf2093911d9528e01e
SSDEEP 98304:emhd1Uryee8hC1/JQZDDU/CglSFXM6o6VLUjH5oxFbxCVLUjH5oxFbx:el+OoBQZDuSlMR6VUjZEdCVUjZEd
TLSH
T1E8262390BBD4C262C1C235FD648343DBDA343F7D153A9A4B1FCA2A2DEC695E27274252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1960-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4580-6-0x0000000000400000-0x0000000000849000-memory.dmp