295fa8aa174b7aa06fd9ddeebb4b0a453a786d7f6e2e903bf1fafcb296be830f

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 10:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_0107a7bc0a04f1a6bdb51b86aba4cd8e_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-mqtebae19m
SHA256 295fa8aa174b7aa06fd9ddeebb4b0a453a786d7f6e2e903bf1fafcb296be830f
MD5 0107a7bc0a04f1a6bdb51b86aba4cd8e
SHA1 7966c3d1271a42afe4a0bbdd780be2334c41d71c
SHA512 7cd9f61bf6463f65baf30203fa67f784d542ecbc6cfce10c54970706f73de9ee0419571bedee65950d611eb7e09ebcadbaab797eeef4bf714a36ba6eafd9f3dd
SSDEEP 49152:boa1taC070U71s/4VfdF1l2AzktD2pTWt6sK:boa1taC0U/Ev2OkeTWt6sK
TLSH
T13D952260F795C2F2C4810A75A56187EAE8792E7C17418D83BFD81B3E1DA4FC09A7274B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3744	5DF5.tmp

Executes dropped EXE 1 IoCs

pid	Process
3744	5DF5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_0107a7bc0a04f1a6bdb51b86aba4cd8e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5DF5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 3744	944	2026-07-20_0107a7bc0a04f1a6bdb51b86aba4cd8e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_0107a7bc0a04f1a6bdb51b86aba4cd8e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_0107a7bc0a04f1a6bdb51b86aba4cd8e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\5DF5.tmp
  "C:\Users\Admin\AppData\Local\Temp\5DF5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_0107a7bc0a04f1a6bdb51b86aba4cd8e_amadey_elex_smoke-loader.exe 2B3725B4B30F028988E9E4F7847459B87D92DBC63661D8C9844DF265D39C9D07A9DC7592240723D654DD32EE27E1A521B7F5D54893F71D52B6704A0BCC116472
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5DF5.tmp

Path C:\Users\Admin\AppData\Local\Temp\5DF5.tmp
Size 1.9MB
SHA256 d570a2d4c13d256ac4aa2466abb56d62b43512408b86624a06bc92330a1da403
MD5 c5a1c01a8d6d00550e39bb3d02658865
SHA1 55e530134b0ef2c29259d23777789323ae0e9a05
SHA512 f5d8e13981c34ff443fc79653a807339ee2ca47faf18970dfd7235c81a41b251678da6cc6e53a8ebced276f62df3cb3df992a671b0e4335cc4fcb6e7d0a978db
SSDEEP 49152:boa1taC070UQR/QAZ+tbx1CTfmvuMkaTA:boa1taC0ex8tbrCTf5a
TLSH
T107952364F7D5C1B1C0D24530A692C7A69876BE7D97858C837BC81B7F2D60EC06A32B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3744-6-0x0000000000400000-0x00000000005EB000-memory.dmp