1a2f95df8b714bf94dda33af24cf31e2a399ab761a69cd2b72b7e992f8aced8d

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_9ffc0616f6fc2a488180220efeb075f9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-rm516acx9k
SHA256 1a2f95df8b714bf94dda33af24cf31e2a399ab761a69cd2b72b7e992f8aced8d
MD5 9ffc0616f6fc2a488180220efeb075f9
SHA1 98fdfea2bb9ac5e0bf0448c16e31fb7c8aef2b4f
SHA512 c9ba5075083a1463603ef50ddb6b21e84c3d931ef88840a9eef722efe2de1cada4981eed33ef32426c3f4776b380c6a81fd7bbd4a267c691f4ec1a8859d0d7d8
SSDEEP 49152:boa1taC070UVxUVOEJBFBUWIrnHqnBtP9Gzqzdf0BU:boa1taC0aVrjvGGP9GwOB
TLSH
T1F8952365F784D2B1C0420A75B691C7EAD97D3E7C87418C836BD82B3F69A4EC05B22B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3004	4DB9.tmp

Executes dropped EXE 1 IoCs

pid	Process
3004	4DB9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_9ffc0616f6fc2a488180220efeb075f9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4DB9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3004	2944	2026-07-20_9ffc0616f6fc2a488180220efeb075f9_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_9ffc0616f6fc2a488180220efeb075f9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_9ffc0616f6fc2a488180220efeb075f9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\4DB9.tmp
  "C:\Users\Admin\AppData\Local\Temp\4DB9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_9ffc0616f6fc2a488180220efeb075f9_amadey_elex_smoke-loader.exe C3A71ABFE4658FFD294ACBC3F07376DD5DB5CF8FC4F6DBD361719ABCA3ABCB12A2876A2072E7C3237567B847431C0B9D687041F15D8C08D8D5E7183199301B71
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4DB9.tmp

Path C:\Users\Admin\AppData\Local\Temp\4DB9.tmp
Size 1.9MB
SHA256 e0a3628736837d9ec6552a82bebd198a46560c945233e09e56cde3952c81c7d6
MD5 ca87ed4a3ad434582bac39c10a54771e
SHA1 7e8d9cb50ac1678ee65d14e1d1d09898b8952b2c
SHA512 998359e7fc586b35bab5b59137076ef4b7559698b380eafc9e56818c4b4fa9001e3d1c82b3ffe9f10c9ad8422e88aee554e2d4e668a30512032e891607a46bad
SSDEEP 24576:S2oo60HPdt+1CRiY2eOBvcj3u10UNqFjNR+ymE2yh5E+hSGXyMpYr5KyYL9ip351:boa1taC070UUVr35cTrYyOI69hnKSVA
TLSH
T1C1952360E795C2F1D08102B1A552C3E6A87A3D7D4B05DD877BCCAA3F69A0FC4693274B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3004-6-0x0000000000400000-0x00000000005EB000-memory.dmp