1445e73a48ab6be49638086efe90ea8269f9dde5a5e690799fabc76040fac559

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_3b2f83f2948d861c3d052e800532ddb0_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-r1rexsdv4p
SHA256 1445e73a48ab6be49638086efe90ea8269f9dde5a5e690799fabc76040fac559
MD5 3b2f83f2948d861c3d052e800532ddb0
SHA1 46302eefba6d1f4a04de4d44b2f3c44da0ae05b1
SHA512 da84b45ff97d5ee5dafe06a4625083bb0d06ad4e912275c37fb8c58c35a7f017f51f51d8a770b967c15f3b13d7129578d1f5d36b1392feb8945d261b51550014
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dKDeDwsWZldgGwy2lUW2QC/CzStDg0Mjx+/Vg:Qoa1taC070dK6DJiqdmftDg0V/CyskTw
TLSH
T1EF952210F794C2B6C0D10971A212C7E2E8793D7967428D877FC92A6F6EA0EC44B76B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2968	39D3.tmp

Executes dropped EXE 1 IoCs

pid	Process
2968	39D3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_3b2f83f2948d861c3d052e800532ddb0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39D3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2968	4060	2026-07-20_3b2f83f2948d861c3d052e800532ddb0_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_3b2f83f2948d861c3d052e800532ddb0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_3b2f83f2948d861c3d052e800532ddb0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\39D3.tmp
  "C:\Users\Admin\AppData\Local\Temp\39D3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_3b2f83f2948d861c3d052e800532ddb0_amadey_elex_smoke-loader.exe 4F3D19D4896FC9F2798AF22AC28F3077E7471D32355CE0EEE7420C492B880BE6FE8A7C27B2744679D3BD12F48DC12E6D31E06F58BE6EBD2D4E08BFAB5FE7D232
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\39D3.tmp
Size 1.9MB
SHA256 155761c4b9e91a1e6ac50d30741ea09c4465a34c20532b17592f044c688da94a
MD5 de5f6b957c29788797968054e058e63b
SHA1 4fc7894cbb0c651f0c58b3ce2d2964bbe42dfd06
SHA512 ed9649b9597c7f210a9d604a5f409cc2420c6ed9103ecb039810643674647a5f9183c94506129f3f32ae5df55fdfc01d93d4f79e35e12595a05187d4a0a18906
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10duF9OLt7kWhw/l3I1GlrQxtMiN6ogUwhvYV7j:Qoa1taC070duFgMd3I+0xtMizgQ93T
TLSH
T138952250F7A5C2B2C0811A71B561C7EB88797E3D46015D877FC82B7F18A4ED42B26B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2968-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4060-0-0x0000000000400000-0x00000000005E6000-memory.dmp