Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/07/2026, 17:51
General
- Target 2026-07-20_430a36c525601eee38259a33131e54f5_amadey_elex_smoke-loader.exe
- Size 3.9MB
- Sample260720-we464sbz51
- SHA256 ea9a61a01de909479ede21d4463039c39eec082e7d23f73d3e71be76f459876d
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_430a36c525601eee38259a33131e54f5_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_430a36c525601eee38259a33131e54f5_amadey_elex_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9977.tmp"C:\Users\Admin\AppData\Local\Temp\9977.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_430a36c525601eee38259a33131e54f5_amadey_elex_smoke-loader.exe 901AE07F699EDDCAC6A826084502C75C9B091A87C6EE6AEF02F13E4F30441F0B7EE86C83D3704A626612A921A4849FD44580D4C4D78B2C083F528F4A559601E12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_430a36c525601eee38259a33131e54f5_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_430a36c525601eee38259a33131e54f5_amadey_elex_smoke-loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
yellow_button_100.png
2026-07-20_430a36c525601eee38259a33131e54f5_amadey_elex_smoke-loader.exe
9977.tmp
memory/3392-6-0x0000000000400000-0x000000000071F000-memory.dmp
memory/4932-0-0x0000000000400000-0x000000000071F000-memory.dmp
memory/5908-16-0x0000000000260000-0x0000000000685000-memory.dmp
memory/5908-17-0x0000000000C10000-0x0000000000C13000-memory.dmp
memory/5908-72-0x0000000000C10000-0x0000000000C13000-memory.dmp
memory/5908-71-0x0000000000260000-0x0000000000685000-memory.dmp