4b805a602e10c2c309032c1609aac281fe183d1b9cb8e4f57b1fd65e7bbeccd7

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_88ba5129babc04f38a367353efa86d5d_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-s644msgy8s
SHA256 4b805a602e10c2c309032c1609aac281fe183d1b9cb8e4f57b1fd65e7bbeccd7
MD5 88ba5129babc04f38a367353efa86d5d
SHA1 02a61dcf647cd0e3cb9e476f9d1191f6a1863759
SHA512 885208c33e4cb492fb5706742d09b1ee8d7390e9d8483df288e68ef1512ffe9c309db28fce16d161eb1bb7102b15430e6053519de91a570fc47c52eb12a788d3
SSDEEP 49152:Qoa1taC070dX6oE9Mv71Bg8n/ua13P1OI:Qoa1taC0bMvdn/zdYI
TLSH
T198952321F754C2B2C0810971A541C3E7D86A6E7D5B865D837FC81ABF3D60EC0AB62B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5904	5F9B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5904	5F9B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_88ba5129babc04f38a367353efa86d5d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F9B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 5904	1240	2026-07-20_88ba5129babc04f38a367353efa86d5d_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_88ba5129babc04f38a367353efa86d5d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_88ba5129babc04f38a367353efa86d5d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\5F9B.tmp
  "C:\Users\Admin\AppData\Local\Temp\5F9B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_88ba5129babc04f38a367353efa86d5d_amadey_elex_smoke-loader.exe 66FDB90E8AFD820DE15902B9898C65DA73DFBA323AE91ED8160CC4E9E4D9387181942EDD42EEF613773588FF7FA0E4F36495D8B13E83905CFB791889EE09994A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\5F9B.tmp
Size 1.9MB
SHA256 952e0a3a840d6f96a4d65c2ca9d13574595e7fdc3e0d18033676fa22574350a8
MD5 d208667b5a99790de72c117bb5d7806d
SHA1 9c40dc57d12d0ab65c063a1a3e33d946d964780f
SHA512 6ac8155d48210e51d7d1ebfa41d0eebbf56789e3379f7b570a7074052121a99ca0d0953564b491eed5030d86b4a999cdac3d6a07f990b87fd1821aa8ea80cc53
SSDEEP 49152:Qoa1taC070dp2etf7rmSZC8a+CVKln6ekmzLatH9QP4P1S4:Qoa1taC0M2SfmSo8a+AKp6exv6G4h
TLSH
T113952361F399C2B5C0821671E162C3E3DC797D7D66418CC37BD91ABF28A0EC06A66B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5904-6-0x0000000000400000-0x00000000005E6000-memory.dmp