6ff9c581b5970b6c2d3a6b1a9dfeb45bb1f64f7ab51016fb47a053587cce08fe

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_335a5d862e3754d8c58420b2daa9ebef_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260718-ka21eady2j
SHA256 6ff9c581b5970b6c2d3a6b1a9dfeb45bb1f64f7ab51016fb47a053587cce08fe
MD5 335a5d862e3754d8c58420b2daa9ebef
SHA1 08322c1dd4932dd84a5dfe6bbaa2f73d150e76ca
SHA512 cc584000ced90dad60724759fd857b3e409732a76c1acf31df62b3bb02a9ce6d87bc7695d781acee09f545542ca39c01866bd3afa31404cc92417678cdd3333b
SSDEEP 49152:Joa1tHC070ULsM+KvKVX3f4RRn+O9fhCFnR+xcNEiemt1p:Joa1tHC0qAWX3fq+O9UFnROcNEO
TLSH
T16F951219FBA481B2D051C5BAD5628BA7D933383A53004ECF17D58F6B2E27AC57630B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5796	4B67.tmp

Executes dropped EXE 1 IoCs

pid	Process
5796	4B67.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_335a5d862e3754d8c58420b2daa9ebef_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4B67.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5268 wrote to memory of 5796	5268	2026-07-18_335a5d862e3754d8c58420b2daa9ebef_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_335a5d862e3754d8c58420b2daa9ebef_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_335a5d862e3754d8c58420b2daa9ebef_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5268
- C:\Users\Admin\AppData\Local\Temp\4B67.tmp
  "C:\Users\Admin\AppData\Local\Temp\4B67.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-18_335a5d862e3754d8c58420b2daa9ebef_amadey_elex_smoke-loader.exe A9C61948592B880D2CC55CD92E3B19C3AE4DC0624A3735EC3B86A3A7150AA044F77A210C7F2C5EFC56B3FCF19F4D809151AA6E40C39DFF50BFEF8F0B5985D839
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4B67.tmp

Path C:\Users\Admin\AppData\Local\Temp\4B67.tmp
Size 2.0MB
SHA256 b39218fe638bd2af13418a67760a33a5a07825717db930d0c80688957024a389
MD5 14b6e3c63ee0b2121075296adec3a360
SHA1 25e08f474acad8cbafdbf153bbef78b9cfee3675
SHA512 e0afb1796e90ea07d057dcea199e4fcb1c6edccb740a4fcb535241601e0bcd82692b00481e9c5eb517d9d4816a0c8488b33eee04a8d8f42356dec05f49b87f98
SSDEEP 49152:Joa1tHC070Uje3nrp6X+kqTLt8Wmiqm2p:Joa1tHC0Ne30OkqTZmi
TLSH
T1E6951248F79881B2D051D5BAE652CB67C973383963404DCB27E58F7B1E27AC1B630B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5268-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5796-6-0x0000000000400000-0x00000000005E6000-memory.dmp