321b188a2b7dec7a560c8e4ba6cd14ec72cdae1a1bd3698f4d1ea69c040c7203

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 19:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_35109dd055a89234aa79c262a97e5d86_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260719-ybbfqsds5s
SHA256 321b188a2b7dec7a560c8e4ba6cd14ec72cdae1a1bd3698f4d1ea69c040c7203
MD5 35109dd055a89234aa79c262a97e5d86
SHA1 879315fe615394c376b7f5386ed15f5f212f474a
SHA512 7d5388b8623fa5f9ef5ca05f62e3c48fc69e256d7fc80bc3e2ba9b500c6fd14f06dbb3d43b7b4d1aabbcf1e57c1d45c5bce0f6b9f7c9eaf7c99f58245fd3b5bb
SSDEEP 24576:82oo60HPdtR1CRiY2eOBvcj3u10UiHRXsyu++86NxgBvhK7tA/bIwNVacVgPeOzw:Joa1tHC070UKI++8uxeCtyUQ3ROzEp
TLSH
T1E4951249FB6881B6D001D4BAE692CB23D573383653004ECB57D59F3B2E6BAC67631722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3460	F874.tmp

Executes dropped EXE 1 IoCs

pid	Process
3460	F874.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_35109dd055a89234aa79c262a97e5d86_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F874.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3460	2812	2026-07-19_35109dd055a89234aa79c262a97e5d86_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_35109dd055a89234aa79c262a97e5d86_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_35109dd055a89234aa79c262a97e5d86_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Users\Admin\AppData\Local\Temp\F874.tmp
  "C:\Users\Admin\AppData\Local\Temp\F874.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_35109dd055a89234aa79c262a97e5d86_amadey_elex_smoke-loader.exe 4403A416D3E5D19837B02F0350E5CF30977399564E13E56EB190620E2990B5A98CE9ACC8ED310B6E2CD99420D2A645E741D37C43787C0029D1C694381B96FC7F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F874.tmp

Path C:\Users\Admin\AppData\Local\Temp\F874.tmp
Size 2.0MB
SHA256 edfdd40eb9a72db99d8af737263cee0a0bc2a381fed4286343359d8d2730fe3e
MD5 9f4acbbac79c71cb78da3982a5af2a63
SHA1 a35cb95d211f33aec6babd22afda881703b6d70d
SHA512 91238b93ac79a60979560964ff426ae2c9662d2f7a58c982c3c8ac5d891a3be584a24de0417586715df139fc6c7b320f0d68b5c879665196ecfdfbd4fc58b395
SSDEEP 24576:82oo60HPdtR1CRiY2eOBvcj3u10U/oGEEtdyL8QQZg29VH26uGsPTzVSrF583e3E:Joa1tHC070UDtPQn29IGszpe7aZyYp
TLSH
T139951258FB6481B2C041C9BAD562CBA7D5B73C7A57004CCB27E14B7B1E27AC9B631722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2812-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3460-6-0x0000000000400000-0x00000000005E6000-memory.dmp