dfe25e3fc7971350e6bec09c6110775bce4790e73c77a017f4dc12eb2c347372

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe
Size 3.3MB
Sample260720-wry6macv2y
SHA256 dfe25e3fc7971350e6bec09c6110775bce4790e73c77a017f4dc12eb2c347372
MD5 0ecc4a982fdaf310434c4dfaebf1c884
SHA1 99b872b12ada26ea1d706ec05d96907173dfb7d8
SHA512 0c7b39d2bab7c55168d8c618efa7b35fa6666a380e21ee4b465d21f53a20b22cee3ad6b6904d2d6dfa5bd493a6d342895dae6e1a81d1c66e972532e432e2a3a2
SSDEEP 98304:QmSWOiIyUdDV4js7zyCjZ6rCOVLUjH5oxFbxG:QXDm47LluVUjZEdG
TLSH
T1D8F522017B00B4F3C2416AF4B48697D7D2203DBB7B5599C76EC4134E8CEA6D9AB17B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4844	1321.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1321.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 4844	6128	2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Users\Admin\AppData\Local\Temp\1321.tmp
  "C:\Users\Admin\AppData\Local\Temp\1321.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe C33E423D28C7B10BFB3B0C7158B16574C571177ED3FB2FA7481200618E9A8BBEBAD0DAF35788483CFA15017550C767962CEC72CFBFD6388E0B951A847C6C90E6
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1321.tmp

Path C:\Users\Admin\AppData\Local\Temp\1321.tmp
Size 3.3MB
SHA256 542daf46ec510a39c8545ddf98ba6f7e15faef0015da830151889d0b1dc9af8f
MD5 f5f76446e0ab2016e1eced4512e07165
SHA1 1c448f8a7e6b27ec62fe70d424fbd56eecb16599
SHA512 386932820f27ad6bf2bf95ef69d77d2fd1e509d0fb86e3eee845e67c83e871cac37d3c00e31e77272891fdd80474b849fcdf710800ffb030d032425c6e5a3f7c
SSDEEP 98304:QmSWOiIyUS0usfvBc0s3qDopf2Ytch2VLUjH5oxFbxG:QXas/s3XZ3VUjZEdG
TLSH
T1B3F522017750B0F3C211AAF4649647D392306DBBBB50AAC71EC4235E8CDA7DDAB67B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download