7800ff5cbd0f02d7715d78dd901514c137f296aea1b2b35fb55a8d032a001e59

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_98e9ecad5cdc8c981ac37b7d892f633b_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260720-banncads81
SHA256 7800ff5cbd0f02d7715d78dd901514c137f296aea1b2b35fb55a8d032a001e59
MD5 98e9ecad5cdc8c981ac37b7d892f633b
SHA1 70ffbc8069c919fe6634fc53127b8fb57af06e28
SHA512 6d709dcbf07b9e9eef189cef7791828deb5adeb01cddec39a2192b42895d82e303caf3562e5bca74f45c51d10869b7d0493dacaeacbcdaef279afd3eb2a27b98
SSDEEP 49152:Joa1tHC070U9f8FkDy/84FSamYSl0d4nitDZtp:Joa1tHC0AFkDsvclYPtt
TLSH
T11B951249E79480B2C051D87AE562DBA7D573387697004CCF27E58F6B2E27AC4B634B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	59DE.tmp

Executes dropped EXE 1 IoCs

pid	Process
2716	59DE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_98e9ecad5cdc8c981ac37b7d892f633b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59DE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 2716	928	2026-07-19_98e9ecad5cdc8c981ac37b7d892f633b_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_98e9ecad5cdc8c981ac37b7d892f633b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_98e9ecad5cdc8c981ac37b7d892f633b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Local\Temp\59DE.tmp
  "C:\Users\Admin\AppData\Local\Temp\59DE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_98e9ecad5cdc8c981ac37b7d892f633b_amadey_elex_smoke-loader.exe AE4795EA69D354D8B15BE75F0D6843A93295F8E0E3C8D8CFB8FF456FCD2AA19698F44FDA93D106AEF672E063D80B4BB9A55843D1D724C2B3A3AB02796EECEACC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

59DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\59DE.tmp
Size 2.0MB
SHA256 30b239b62f497c69f0184d70baceafb4a729c17dc43a6a4e81f52edba4abcb76
MD5 d2ce74cff9f71a3cc7196cf3e69b6ef9
SHA1 6b3efb805e596d3e6bd216b209970820de116fc4
SHA512 627ac7ae6134149eee46ca530a98c129df43262e26dffd7aa6244ee0b4f3ab19efc9cb8e08f8100ee08ceb7da6b5ce386557b3b9cc2a835d411c6bf1d61183aa
SSDEEP 24576:82oo60HPdtR1CRiY2eOBvcj3u10UEF6R3Yqmd9DJ/LQLg/8Efjy+gPEe1oUAghQt:Joa1tHC070UI6ODxJ6Oy+GggeQGfp
TLSH
T134951219F76480B6D081C8BAE6A28B63D473387697018DCB27D58F7B1D67AC5B231723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2716-6-0x0000000000400000-0x00000000005E6000-memory.dmp