52b583ab97846b2de007eb117600d1cd739c794b13db351ca9764730be7cdf07

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260720-ra2g7set41
SHA256 52b583ab97846b2de007eb117600d1cd739c794b13db351ca9764730be7cdf07
MD5 fe7fc3c8f3e139003282c36ddb3d0fb9
SHA1 f6eefa854b87840ab4a22d4ece57934c06dce4e7
SHA512 2ff9f2837be00d6c9f27b29daea2524364247ad3b07b21220be2d82d291a2eb98ba6c9e9b77a0742e458d37ac73ee20aff9557f3fa178a18ca5ee3b6b62e3b49
SSDEEP 98304:emhd1UryeNETU2I1etXVLUjH5oxFbxCVLUjH5oxFbx:el6TMetXVUjZEdCVUjZEd
TLSH
T184262380B7D4C362D1D275F9648343DAD9343F3E1276994B2FCE1A2EEC688E176B4252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3036	CC8D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CC8D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3036	5100	2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\CC8D.tmp
  "C:\Users\Admin\AppData\Local\Temp\CC8D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe C7D744AB0190B0C2351AE0859C182D63EB14704186D154D9EBEA0FF769829EE9AD6BB88175DE4269FC47AB379FF30021AF562ED1947BC31C44C70BC86F298100
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CC8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\CC8D.tmp
Size 4.2MB
SHA256 5b641eafe4c0172ba151bb46c4cd36ab785069aad75b65745e2ecc8fd6a9f29e
MD5 05729dcd9a79907f2e98bb5e8a758623
SHA1 9abb3c83f97119a8df3acae9c17321bc28a92022
SHA512 152e378074f989a970f7483dd74561700300c721f3d1f1bed9476ab6a4643ac86620dbb847fc12580ff106a4ef9fdfd68c8bf6178569dd5186aace81cad765d0
SSDEEP 98304:emhd1Urye7se08kys/+pVtmMSVLUjH5oxFbxCVLUjH5oxFbx:elG/T+BsVUjZEdCVUjZEd
TLSH
T141262380B7A4C272D1C279FA648343DBDA343F6D0176994F6FCA1E1EECA99D17274242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3036-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5100-0-0x0000000000400000-0x0000000000849000-memory.dmp