0ec5fcad1be89ee60935f99158da12fd6c63550273c6dc298b5d6f3ef0b4eda1

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260719-b9a7ascs21
SHA256 0ec5fcad1be89ee60935f99158da12fd6c63550273c6dc298b5d6f3ef0b4eda1
MD5 923d74f01aee52a867aad4184fe3760f
SHA1 46abb642676cd279ff6b4d7ff4a971db18bb3fa0
SHA512 339ee7a06926dd426df4b8d4c02c312ce7b2b714f7b31e28e52bde4faa0d9fcecbc679fa2e6d870e52a319b35bd611860bb3147d4b29200ff8e429cfec1c8ab8
SSDEEP 98304:emhd1UryeYdD5YFVZ3FYGl9kVc5VLUjH5oxFbxCVLUjH5oxFbx:elsD2FVZmjVGVUjZEdCVUjZEd
TLSH
T11A262391F7D4C261D1C235F9648383DADA343F3D5139994B6FCA272EDCA88D672B8242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5000	9BA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9BA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 5000	1208	2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\9BA.tmp
  "C:\Users\Admin\AppData\Local\Temp\9BA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe 5C556E192B49ECDAEDCCFE27D69496A06A02469613B3F624E49F4103DCA422001C86C0028084166AB0E1D496510E8CD50AC252C013B986669F2BD46B0DBFD129
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\9BA.tmp
Size 4.2MB
SHA256 476848aecd3491df30fcf29ccc733571d42066631007ccace9586c157412727f
MD5 741529fcd5a7481ca4fa631f11d7b8ef
SHA1 0287f727f68b481edcf6c9204c989d889b1c57cd
SHA512 7c4d6a0a83056cbb216a12574a81c86617dc197dcaa03c88f75bb3c2a31af41f97f6c6a7d752e3f09e1b9741269584a8745705a68d2794bbbfa1eadb8ca4a725
SSDEEP 98304:emhd1UryeuhiaP5Em9TLvShVLUjH5oxFbxCVLUjH5oxFbx:elJa9LahVUjZEdCVUjZEd
TLSH
T13C263381B795C371D1C275F9508343DED6343F7D06769A8B2FCA2A1DECA85E27278282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5000-6-0x0000000000400000-0x0000000000849000-memory.dmp