04b078a5b68a6ad230dfcc12bb037a479878c18b70066f402f51f91cfdfe43c4

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260720-sr4vbset7l
SHA256 04b078a5b68a6ad230dfcc12bb037a479878c18b70066f402f51f91cfdfe43c4
MD5 f6de382fd6699c02621494bf4b5e7b37
SHA1 4c969f760e543593186e09de3c90fc078db9cbb3
SHA512 cf36fae51cd6c8ee145be58370793f9abab98e653eb586a6a1b2e06ca64ef17aa7cba4b028f5c998cbac3a04e8393d54b0fbbba21e5d79b7f81e96101d4a0edf
SSDEEP 49152:Joa1tHC070U9mJld5ZwopnClX1P3ezhSLe0p:Joa1tHC0CJP5Zwopn6dn
TLSH
T1B7951249F79880B2D042D4BAD5A2DB66D073387653008DCB67D48F7B1E27BC5B632B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3832	37CF.tmp

Executes dropped EXE 1 IoCs

pid	Process
3832	37CF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37CF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 3832	6012	2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Users\Admin\AppData\Local\Temp\37CF.tmp
  "C:\Users\Admin\AppData\Local\Temp\37CF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_f6de382fd6699c02621494bf4b5e7b37_amadey_elex_smoke-loader.exe E26F06933A21D63C4C15658FC0F944C44582A4C552A49AB245C748252A9E0E7921CA6B21EFC1590D003FF986448DB0D88893D14DDC22AF650BAC9DB1DB08CA24
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\37CF.tmp
Size 2.0MB
SHA256 b338b000ae5a8890493a60db0f6801f92de8058f739a861740f1cb1a85a169ce
MD5 b2efd3d9a365dfe47867cf368982ef0a
SHA1 e91e652fa8a0b504c64c341e1837432367acac31
SHA512 c1a400582045d20487db992a13690122e56dea49bc0b87d6fdc3d95cabb6035e5328fec1031221369c0937fc0bcbe5eaa3fc5f79ee972a9d9acac59e0726f068
SSDEEP 49152:Joa1tHC070Ua38k8TqlqfSa7iWMP8f6C0p:Joa1tHC0w38k8O0aiyP8f6
TLSH
T1B4951259E79880B2C081C8BBD1A1CBA7D573387667008CCB27958F6B2E67EC57235763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3832-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6012-0-0x0000000000400000-0x00000000005E6000-memory.dmp