74a4e3ee2adc187608e58f56dd6517d4ab9e29b620aa0dfc285cba189258f7f9

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260720-kcsvhsbv5q
SHA256 74a4e3ee2adc187608e58f56dd6517d4ab9e29b620aa0dfc285cba189258f7f9
MD5 ec42a62c62af76946d70da6cec8717a0
SHA1 521ed2a35ffb45861cccdf7a2aa18b8a95d67ab5
SHA512 f0704495c851481b82547cc140804de2159352f8372c77e350fdb4c77020233b23b6c2b67d181cf748573ed81b2682de7a3e7111675c29b93f6bc79e6bdd033e
SSDEEP 98304:5mSWOiIyU8n/+frO0En24IeVLUjH5oxFbxx:5XNjOQHeVUjZEdx
TLSH
T1ECE52351B7D4C2B2C08225F9648343DBD5783E3D1256988B3FCD2A2FA8A89F17779643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6032	1013.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1013.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 6032	1104	2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\1013.tmp
  "C:\Users\Admin\AppData\Local\Temp\1013.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe 1861166746072AFD09C177D31C027CAC52FDF224EA6FB69B43DAB5329311B99B1BE56BA6BB04558C381C7D64C599E6BF44A0E96EE1F598260EF62F21865255FF
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1013.tmp

Path C:\Users\Admin\AppData\Local\Temp\1013.tmp
Size 3.1MB
SHA256 bfb51bbae0fd490b9d1940efd059dd2e2bf196afa89131c1e361d203324ad951
MD5 d89bd21c041880411e0494b4569cfe8a
SHA1 a82c2e8a555322060c56b42f0c2e5e70b66b7ec1
SHA512 d051c880d274630501d21af2a89cedf3abc73e359f404859f09d3e24ce40d0c408353d87666890bc32632b5a00535451ce133cc7b6e4d44d3d55f07026ed62a6
SSDEEP 49152:Fvm22OdWOXqrbIyUJGtjFoFhPQxHQihAJe4/zuRwLVT5kUvgJSgHT6ojkxFbxLWo:5mSWOiIyU/hPyhCe4/zxVLUjH5oxFbxx
TLSH
T110E52341FB90C2B2C14131F9B08383DB99393F7D56669A8B3FC9261EAC649E07676743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-0-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/6032-6-0x0000000000400000-0x000000000071F000-memory.dmp