4865b81da8e2bb731c0a50ea6be4f05ee184b37159c3c80c0b0d932f108dd9cd

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260718-ctsbbagy5v
SHA256 4865b81da8e2bb731c0a50ea6be4f05ee184b37159c3c80c0b0d932f108dd9cd
MD5 b8daefd10b8ef0706e2e83493be69da9
SHA1 015af2e8be76fb91daf148ee890c4e81470ee470
SHA512 ad80f655a5d1bee7b35d8a8254de428371e2bbb50eda60ca2e12267afc2805ab0ea941afa202bf04135ad384b716ba74461c76caf29e99cdd767c219bb86e292
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dLRf6Pi2j1F5sgIDs5qXZLYo6z8emuUYIAQLT:Qoa1taC070dLRfTOeYqCz8Tu4AymG
TLSH
T189952311F790D2B2D0C50671A592C3E3D8B93E7D62458C877BC92E3E2DA0EC4AA76717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3612	7E2F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3612	7E2F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7E2F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 3612	5732	2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\7E2F.tmp
  "C:\Users\Admin\AppData\Local\Temp\7E2F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe 9C2092E2BDF3F0B13234DD926B1D997CB8E417DB7051A2C914146637569A87301E7552BA52A96C86E02EDB7C310E79052A3CDC6C49361F883FDBC5169A2EC601
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7E2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E2F.tmp
Size 1.9MB
SHA256 e60da676d4b4b234e04166547298310984d712132fc3875549d4805dd746f94b
MD5 b444037269a38f0c5b1875e66e049816
SHA1 1b3cf47b52841bd56dacff0eed3af313e5f83695
SHA512 75c8f7935b9467aa5ef5ea74d1189aef57fb9b1016ebab5be8d1cb025937f935ddda97fb84ae9cc61294de69582ec59e618bf65690796e810855c34383765a17
SSDEEP 49152:Qoa1taC070djrQLy8damUoa02Cek6Bj3ENSZAxtkW:Qoa1taC0UrQ1Sn3qGMtF
TLSH
T1D5952220F395D1B2D0810A70B691C7E6A8793D7C92558D8B7BCC2B7F6894FC06A7271B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3612-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5732-0-0x0000000000400000-0x00000000005E6000-memory.dmp