39d60466fcbcb83ed310295e6aeeb602abde4482c9c642b765b942bebb4f13df

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_99638a57a0f48720bfefc42cf45a255a_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260720-bae17sax5m
SHA256 39d60466fcbcb83ed310295e6aeeb602abde4482c9c642b765b942bebb4f13df
MD5 99638a57a0f48720bfefc42cf45a255a
SHA1 8d5339ed89d730d3feb4d3f350be612bc95e7bde
SHA512 9d4cea03707b23b040dca20dd6147ba6498057962444161debdd138204f4d2fbcb449fdcec0a032477861b0b790a33242383febac54a041bcbed15d5dee94dac
SSDEEP 49152:Joa1tHC070UbKe6j5Ea0nwcq87UgSNakqEzWdg6p:Joa1tHC0pKeOyZnHv7U7pza
TLSH
T141951258F79880B7D081C97AE6528B67D8333876A3004DCF17D58B6B1E27AC5B335B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5692	5346.tmp

Executes dropped EXE 1 IoCs

pid	Process
5692	5346.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_99638a57a0f48720bfefc42cf45a255a_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5346.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 5692	4312	2026-07-19_99638a57a0f48720bfefc42cf45a255a_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_99638a57a0f48720bfefc42cf45a255a_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_99638a57a0f48720bfefc42cf45a255a_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Temp\5346.tmp
  "C:\Users\Admin\AppData\Local\Temp\5346.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_99638a57a0f48720bfefc42cf45a255a_amadey_elex_smoke-loader.exe 64EB714BBDFF482DB4AB30AE72839A74BBD278DDDA7BF85ABD8367B53D065D66D893BCADE5CD879B70A0A911BE09F897D93C06054BA69620B6575A1B918468FA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5346.tmp

Path C:\Users\Admin\AppData\Local\Temp\5346.tmp
Size 2.0MB
SHA256 4a8dde7f5611ec5a1173c54007da3a507758b8d555f3fafcfbedc5384733250c
MD5 3286fd729c728f8c99f9cbe2c02bdae8
SHA1 5a68bb0e7ed228ca030e5269a57ce077d4947b73
SHA512 fa0462f931f1965c5c719246f0871d0f4626f03c0cfa4860adb4d8a858e609ec1f10f2cfe925b1b4cf5512d19ab813df18ff865e2361e58e151e31a14b7c71f2
SSDEEP 24576:82oo60HPdtR1CRiY2eOBvcj3u10Uzf2oQNU6JR8/LJF+wdd9V7EPaWrt5cMUtTv:Joa1tHC070UL2fAOwddj4t+MC/vcp
TLSH
T1BF951219FB9881B2D091C47AD652CBA7C473387663008ECB17D58F3B1E27AC5A635B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4312-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5692-6-0x0000000000400000-0x00000000005E6000-memory.dmp