7ae4ce9a15b0fda12a32c6559f140eedc0883e24e5d8116efd7932ba947ae2c3

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_52463900922c9cc2efee6c7bdc1913d4_amadey_elex_smoke-loader.exe
Size 2.1MB
Sample260718-jxrmhsds5m
SHA256 7ae4ce9a15b0fda12a32c6559f140eedc0883e24e5d8116efd7932ba947ae2c3
MD5 52463900922c9cc2efee6c7bdc1913d4
SHA1 94e514de8bf73d525b7ea533e605e35c6f496c78
SHA512 6384d53a893efd0cd3f0bcebcca6f3912c7bafb8c33c6fc1506d92532c59791ac02c92a8f84e081ac8f03fb05057dea18cc0ca118d7ddada45c3307808edbefd
SSDEEP 49152:yoa1taC070UZXJgpzDqIZBwAy9/+iwK0OHDxvOJFIw4l:yoa1taC0rYDqK9iwe
TLSH
T111A51201B710B0F3C6116BB07556DBA7A6216CBB3B05DDC72984239F18DBAC89F52F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
860	FF0C.tmp

Executes dropped EXE 1 IoCs

pid	Process
860	FF0C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_52463900922c9cc2efee6c7bdc1913d4_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FF0C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 860	2820	2026-07-18_52463900922c9cc2efee6c7bdc1913d4_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_52463900922c9cc2efee6c7bdc1913d4_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_52463900922c9cc2efee6c7bdc1913d4_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\FF0C.tmp
  "C:\Users\Admin\AppData\Local\Temp\FF0C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-18_52463900922c9cc2efee6c7bdc1913d4_amadey_elex_smoke-loader.exe 7CE6017C0D9D3B5EAEAC9D6E78B5189BC408ED22257DD8832404A7F4CCF01B17D00C074DD9A90E6F4F2BF75234F7F46B6077B83C51BD6AA9C4F2606B76E02A99
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FF0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\FF0C.tmp
Size 2.1MB
SHA256 20c11836fed762160d1b5d728559ab3d49fa1af7aa3dafac8ec38c99c9e230a9
MD5 95b6e8af6b29289d73a93b7629643877
SHA1 563f51de47bf28a0f242f8f8b0397d64f23a3e59
SHA512 186056e114a3fff926d210deb8cce309d362cd1e9a0f7b73028c0527dcd9e60bb3a096aafd6f17baffe9744ce73ffa686b829f14185cdbd1d011ab40da3edb9c
SSDEEP 49152:yoa1taC070Ut/mylRBvAdZC/K1urQVxvOJFIw4l:yoa1taC03/LvSIK80
TLSH
T112A51201B704B0F3C614ABB0A655D7D3A6206C7B3B44EDC76984679F1CDAAC89B53F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download