cc2727fc22fbcf0d4108c37aec864fed66c5d6d62df8f0b92218d6525de65f3b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5f8e807b334c0805703af8dcba2a6c98_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260718-d8akgsav71
SHA256 cc2727fc22fbcf0d4108c37aec864fed66c5d6d62df8f0b92218d6525de65f3b
MD5 5f8e807b334c0805703af8dcba2a6c98
SHA1 e8bf699b2a7cf5b0778a4679f1730a4573e13bde
SHA512 ede77fb2c63dce703563424997a538dd63b03b8174b201d4b636cbd593eaa2465f5366f22f6d6e852050adff345de0a438f5bd46dd97ac73954061d71f74f00b
SSDEEP 49152:Qoa1taC070dsIQNbwBFMRkY0jlEIVq6KOtg:Qoa1taC06ewzBpY6KO2
TLSH
T180952240F795C2F1D0825A31A092C7E39D792D7896849C877FCD2F2F2E90ED46A22697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2796	F44E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2796	F44E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5f8e807b334c0805703af8dcba2a6c98_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F44E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 2796	3116	2026-07-17_5f8e807b334c0805703af8dcba2a6c98_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5f8e807b334c0805703af8dcba2a6c98_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5f8e807b334c0805703af8dcba2a6c98_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\F44E.tmp
  "C:\Users\Admin\AppData\Local\Temp\F44E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_5f8e807b334c0805703af8dcba2a6c98_amadey_elex_smoke-loader.exe AA21B5FA7AD71052919D17E769CB53FEA8BF0CFBBF20111D1C88DDE4B2C92B2713FE965BD8993377A765EDCAD477D93268D86FF3AA416B1075A30E7ABAD2D870
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F44E.tmp

Path C:\Users\Admin\AppData\Local\Temp\F44E.tmp
Size 1.9MB
SHA256 18f325f055a3fcf1a4d0aa675990cae1689b90722d1c19615b5f3412df9611b6
MD5 e89b5d0dd506ac54172d03cfdaf71196
SHA1 9a096f08f77e894d610e4d7c3bd3c01035735552
SHA512 3b27741887abfee11efebd0efe838342eb357c1b868676d204fa40f0f0d0ecef3e182cb38bbdccc495d776f069a282cd71b9a5f9d94a0bd8fd570c9a4485202e
SSDEEP 49152:Qoa1taC070dfMpHi7KTKi3MP5LWuiC7Nj4N3p:Qoa1taC03pHiWe/ONZ
TLSH
T1B0952220F7C5C1F2D0960672E691C7F698683E7893428D877BC82B2E2D55BC06B72B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2796-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3116-0-0x0000000000400000-0x00000000005E6000-memory.dmp