2c7a0c18015b29ceba3b375f35f69d468a459d3d7ad66e3329eb99bf5114f992

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_4cb3d620a4f245d2cacd00daaeb3d2e2_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-ryt32aft6x
SHA256 2c7a0c18015b29ceba3b375f35f69d468a459d3d7ad66e3329eb99bf5114f992
MD5 4cb3d620a4f245d2cacd00daaeb3d2e2
SHA1 9579c70069265097e8eba7be21c8d665d1aaf881
SHA512 e2df3c673a360a1966789eb6ad4af79c1795971837fb61d0dc504a2d2fa3a0d3712f65c376ffa165af7dd77ea17d9c0b8a4f67915ed86bfe6f184fcb2a9b5f13
SSDEEP 49152:toa1taC070Ufn4Sdou34pdhHhqvcrzdSHs:toa1taC09H+NpXMMx
TLSH
T142952221F794C2F6C0C10671A551C7E6DCA93EB85B468D837FC82B2F29A4AC16B31B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2268	81B9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2268	81B9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_4cb3d620a4f245d2cacd00daaeb3d2e2_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81B9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5976 wrote to memory of 2268	5976	2026-07-20_4cb3d620a4f245d2cacd00daaeb3d2e2_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_4cb3d620a4f245d2cacd00daaeb3d2e2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_4cb3d620a4f245d2cacd00daaeb3d2e2_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976
- C:\Users\Admin\AppData\Local\Temp\81B9.tmp
  "C:\Users\Admin\AppData\Local\Temp\81B9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_4cb3d620a4f245d2cacd00daaeb3d2e2_amadey_elex_smoke-loader.exe 70F5ACFEA376BEE881F4BB59E117D0DD7B9928ED81B355E642F8D08A0DBECA71F9FEFC89703200EB04F7E00E8D56DF48F881451BD4A15AEB885D6BE4B44545D6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\81B9.tmp
Size 1.9MB
SHA256 32cc5902b36875ab4b4afb833bd91b25f85a2694bc03b4e5886444a22556dd39
MD5 6b38e347585fc949b385fdc1b5fd0388
SHA1 97b907b03a9d938eac287d7e065a357e8bf0260d
SHA512 18129f4cd4df77a85229c02d0325e48fe6a92728176fa331c2b6e44877339e8b2cf26706630dd48561a99975758cc695d240c0f7a631ac6d73a2a0d5d48443db
SSDEEP 49152:toa1taC070USEkYOkb1oDCO1Y+7M3CDhoKjUkkd5:toa1taC0yYxBoDCO1YKxZtkX
TLSH
T1C8952350F695C2B2C086093599A1C3E6E8793D7D96414D837FCD0B7F29A0FC0AA75B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5976-0-0x0000000000400000-0x00000000005E6000-memory.dmp