3c25d9f066e891b19848351c83c24f881a0c79f97f4aec3a51c1ec14b25f5d15

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_440ca7b86eada5ec08367619dad3a368_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-went5aas7q
SHA256 3c25d9f066e891b19848351c83c24f881a0c79f97f4aec3a51c1ec14b25f5d15
MD5 440ca7b86eada5ec08367619dad3a368
SHA1 3189e4c82ff57530536a958984c306745085be14
SHA512 adf7228482fc9622512447acd9fafeb70aa06764b475d23545d0935ab09a29930b708161c9a0bfc7a3d04cd3bcc2e24fdc7e4bd5f43ce7e959ca18ce1adf6a34
SSDEEP 49152:eoa1taC070dNlRQM9shYS99hps8Yke2xtW0b:eoa1taC0ElSphYS99r6kjxtb
TLSH
T132952210FB95C1F5C0C40634B6A1C3A7D8693D7D52558C837BED2B2F2AA0FD86622B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1184	1498.tmp

Executes dropped EXE 1 IoCs

pid	Process
1184	1498.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_440ca7b86eada5ec08367619dad3a368_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1498.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1184	2592	2026-07-20_440ca7b86eada5ec08367619dad3a368_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_440ca7b86eada5ec08367619dad3a368_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_440ca7b86eada5ec08367619dad3a368_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\1498.tmp
  "C:\Users\Admin\AppData\Local\Temp\1498.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_440ca7b86eada5ec08367619dad3a368_amadey_elex_smoke-loader.exe D71D8C12DA84C3543E67DBB287027A5033860261E99BC8D8E94C7441CA56FB2967123224E67EB7658A81E6EC64B2F919A4F2F1236C0565515253727CBD977C47
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1498.tmp

Path C:\Users\Admin\AppData\Local\Temp\1498.tmp
Size 1.9MB
SHA256 e7e6d638a60b1a6b12618c5a91769a03e51c883d61fa656737dd455846f5bd47
MD5 3fffb58481001b20a169c6f8ac8ef467
SHA1 43e5d30b7f17de04a8c101c94681d6c44dcaec43
SHA512 f00b54bbd879730e0e9294097c827a6b9b376f5018c565836747fdbceb4211823cb5b35a805e84d6b9ea07dfadadb41bd091fc55504d16c44db3e6cf2292cdb2
SSDEEP 24576:P2oo60HPdt+1CRiY2eOBvcj3u10dlZyrv1+6YHhbIgNgzxs2AQw4yoGjRvfw+BGb:eoa1taC070dqD1m2nBAQ8tvjkBpj
TLSH
T1E7952250E791C2F2D0851A30E192C3E2986A3EBD97419C837BDC1B7F59B4EC4AA71A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2592-0-0x0000000000400000-0x00000000005E6000-memory.dmp