6f04eff02a5d1e9d50ab2eeb28323795bf3e2612d1de2e1dbabe3c8d6cf13d86

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b1cda2ff8852142c315b7e64a36d0138_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-p4qlpacz3v
SHA256 6f04eff02a5d1e9d50ab2eeb28323795bf3e2612d1de2e1dbabe3c8d6cf13d86
MD5 b1cda2ff8852142c315b7e64a36d0138
SHA1 651141c61bb15959c9e622c0e8f4d07f84dc8ab3
SHA512 7978b243fc7027b2bab9c456443d3dd7ece11a5d552a004ad92aaf77a8983a675cbe5568979b6f08bec0e6259de3bb6f7c46dbfc09152133cabb16f1cb3c1dba
SSDEEP 24576:S2oo60HPdt+1CRiY2eOBvcj3u10UU/jZhZpeOH4BunX8OMreU6ouHxMRIz3Hhc/q:boa1taC070UEX1pnsOuePiIz3hUTj1M
TLSH
T133952220F791D2F2C0C10A71A252C3AB99793EBD57468D877BC91B3F1D64EC05A22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4892	41E1.tmp

Executes dropped EXE 1 IoCs

pid	Process
4892	41E1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b1cda2ff8852142c315b7e64a36d0138_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41E1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 4892	1756	2026-07-20_b1cda2ff8852142c315b7e64a36d0138_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b1cda2ff8852142c315b7e64a36d0138_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b1cda2ff8852142c315b7e64a36d0138_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\41E1.tmp
  "C:\Users\Admin\AppData\Local\Temp\41E1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_b1cda2ff8852142c315b7e64a36d0138_amadey_elex_smoke-loader.exe F4508216BF55E60A652CC029C8B718A61DD9604BF0D1C6B6709361316BC8DF9C363E8E1CFE70679470B59695B5AE9B019BD8ABA7A1FA6E1DF0E99563A7998F16
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

41E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\41E1.tmp
Size 1.9MB
SHA256 b509bad60d28060f40ce3d2139c8b66d96d91a7cfa9ce2cbf7ee22d55924e835
MD5 21d111d27fe1fdc4fbfb890499f88127
SHA1 2f3fb7f1476588074dd4d9f6661b040785a12120
SHA512 7340e574504aa3a8e49bbb9e9609216c6666ca305f9da5ac6c59b39fb466667b87bd5dfd1fab4316b9449f5c61e1faf6c3ad60e19692b0de68bd255c6f490459
SSDEEP 49152:boa1taC070Ub2UTenoRFlJMqDTLgXjLI:boa1taC0JcnoRrnT8k
TLSH
T187952240F7E5C2F2C08116757661C7A3E8B53E7C96419C876FD91B3F28A0EC06A62B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1756-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4892-6-0x0000000000400000-0x00000000005EB000-memory.dmp