80a509c341dfacef5171cb2750bf5285b40e5bc9e4fa8cb6afde2c731ba3e769

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_36efa3fa50ef13af304e20969df14d40_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-r2be4afv5v
SHA256 80a509c341dfacef5171cb2750bf5285b40e5bc9e4fa8cb6afde2c731ba3e769
MD5 36efa3fa50ef13af304e20969df14d40
SHA1 2e935e8b18f88c2c2712f5c700eee8672f25e3dd
SHA512 439da8083394fd20f306e4c0e9724d7326cd85137805c2199e4adb7b54052f2d89f209671ce246089cc371923524b214341d3106a92ba8367618cff7725c9e03
SSDEEP 49152:Qoa1taC070dQqXC5VEqC7rOEDKkCKCTOVGxKFj:Qoa1taC0RysEqYOiCK/oKFj
TLSH
T137952205F3D1D2B2C0924572A292C7E6DD393D7A96068C837BC92F7F19A0EC06A7571B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4440	F74C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4440	F74C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_36efa3fa50ef13af304e20969df14d40_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F74C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4440	4076	2026-07-20_36efa3fa50ef13af304e20969df14d40_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_36efa3fa50ef13af304e20969df14d40_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_36efa3fa50ef13af304e20969df14d40_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\F74C.tmp
  "C:\Users\Admin\AppData\Local\Temp\F74C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_36efa3fa50ef13af304e20969df14d40_amadey_elex_smoke-loader.exe 84D5AAAF3BBBB0D8BB9305A7943CA4B8913F085D4FC0B72B106743F62E46923116FEE8A0F249A4433A2802EC255336A7FC4A1ECA53BF39776BEC16ACA54C264B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F74C.tmp

Path C:\Users\Admin\AppData\Local\Temp\F74C.tmp
Size 1.9MB
SHA256 b89f20dc6eb964839a6cedad88a911bd839b89892203e28bbcf6dcdeb4cd18ad
MD5 36daaa0e4e2ed6334357e44e066eea51
SHA1 d67cdf929d0ad3bf72a3ffd8ba0259860a1fbdc7
SHA512 36eac11d9434a1ec4d8ad4ea52598c65348aa21534a26a5fd6eac9c5f17a294afa4c5da0070c3d300981ef9e0e0cea4cc0fefe0feaa7e36ca7a92fab1b52e580
SSDEEP 49152:Qoa1taC070dJ8SIYqLKohs7F6I46yR2cc:Qoa1taC05NHsg6yR2cc
TLSH
T132952320F785C2B6C0910971B562C7E7CC767EBD96418D877BC82B6F2890FC42A71A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4076-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4440-6-0x0000000000400000-0x00000000005E6000-memory.dmp