3546c51cdf86c853b59a157c95e7f95b281434914b84b06086ce7efa94f17ef0

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_907c4f2a26fa7e947cb5facc0415d869_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260720-bcnfcsdt6t
SHA256 3546c51cdf86c853b59a157c95e7f95b281434914b84b06086ce7efa94f17ef0
MD5 907c4f2a26fa7e947cb5facc0415d869
SHA1 a0c563f88202378c9806793e0b5b83e8899aa5a0
SHA512 99c72b81bd2cd8be1573843e9f56216f56ed4603fd4e0c10cc69fbb92159554e29465df483d21ee9c50601bbe29020b1ed168a7a5d114b8fc3d4950a9c24141a
SSDEEP 98304:emhd1Uryewebqma30xwqTtwV7wQqZUha5jtSyZIUS:elQ6u3F4w2QbaZtlir
TLSH
T12B56BF05DBE8EF1EC91F03B590B2222657FAD494DB83AFD6A951F5B07E82310BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4756	DA1F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4756	DA1F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_907c4f2a26fa7e947cb5facc0415d869_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DA1F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4756	2552	2026-07-19_907c4f2a26fa7e947cb5facc0415d869_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_907c4f2a26fa7e947cb5facc0415d869_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_907c4f2a26fa7e947cb5facc0415d869_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\DA1F.tmp
  "C:\Users\Admin\AppData\Local\Temp\DA1F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_907c4f2a26fa7e947cb5facc0415d869_amadey_elex_smoke-loader.exe 5495AC68B8142810D1F22176CBE4E2F80082C144FB6581CF2C842FF39F3C316E375C641E3C1D04E138869B88271EA542FE0FC120DC28AB00D0952DA60CD90078
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DA1F.tmp

Path C:\Users\Admin\AppData\Local\Temp\DA1F.tmp
Size 6.0MB
SHA256 12779e1748c2487d8d7137e6f4e1f77741baa3cdbb4e0951e896cf706335e8e8
MD5 d5f9984272f561e3354ac2b5061ab1a2
SHA1 93be5fcdc34f7e21167b5705cb718d1e3dad5d4b
SHA512 312d9288349cd1dbc88b8de2e04b0a3daf61d2f4220b2dab2d95759019d9e64e4b985222614d78aa126f00645dafff1fb1c73d8a761700c6d35a569ad4497c7e
SSDEEP 98304:emhd1Urye4dSiUAcsd7vhOrDV7wQqZUha5jtSyZIUS:el+aHc7Zc2QbaZtlir
TLSH
T14156BF05DBE8EF1EC91F03B590B2222657FAD494E783ABD6A951F5B07E83310BD42163
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2552-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4756-6-0x0000000000400000-0x0000000000849000-memory.dmp