4e71740be02d062aaee88cf5548531f964385221cf5022ef9745455f687d129a

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_2d0311b931d17f574ef3cf8df978b144_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260719-ydvbmadt4x
SHA256 4e71740be02d062aaee88cf5548531f964385221cf5022ef9745455f687d129a
MD5 2d0311b931d17f574ef3cf8df978b144
SHA1 182146da96c955fea230b8b99232149acba26ceb
SHA512 74090b8d20f5e748e1d3e3f6cc38717a11c46ba70aa7ece3a30d17d3f0e08d8927f15a612d491fdd46d3bac24262a5b965839f3edb968c312de22e7f000fca21
SSDEEP 49152:Joa1tHC070UGJbxXpv+VwFkJCkIItULM1AcErwuAKp:Joa1tHC08H4RJCkGcx
TLSH
T15A951208FBA481B3D041C9BAE562CB56D473387A53008DCB27919F7B2E67AC5B731762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3324	143A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3324	143A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_2d0311b931d17f574ef3cf8df978b144_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	143A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 3324	4608	2026-07-19_2d0311b931d17f574ef3cf8df978b144_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_2d0311b931d17f574ef3cf8df978b144_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_2d0311b931d17f574ef3cf8df978b144_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\143A.tmp
  "C:\Users\Admin\AppData\Local\Temp\143A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_2d0311b931d17f574ef3cf8df978b144_amadey_elex_smoke-loader.exe E6F337741F914F1F3E1702697984069E7090B5F5885AE85AF92FAD22475FD11B7C27575B63C737615B9FDB81CF724CE87B0197A81117BF400DBD4610E83B37F3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

143A.tmp

Path C:\Users\Admin\AppData\Local\Temp\143A.tmp
Size 2.0MB
SHA256 c97373e1f87a1c8e666254483c0947490572d8bcfd9f428d55d215c7022c1068
MD5 b6814f1aec20f75c430a47443be43647
SHA1 503c35b3bbc520a80cf8e70db688d717099282a8
SHA512 47c095cf7edba7013a1e55ffae18b2cedc88578cbdd8afba682c0c5664db7f9ebdb318d691f70f665200fc54acbfc9d30a7ae6c3d4025e1ac06667dceed38464
SSDEEP 49152:Joa1tHC070UMbM7nH4lI8gbVfyW7Y8lb13X3TR57p:Joa1tHC0idfMjlb13HTR5
TLSH
T1FD95121CF69480B2C081C97AE6A2CB67C473387A57005DCF67948F7B1E27AC5B6357A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3324-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4608-0-0x0000000000400000-0x00000000005E6000-memory.dmp