09d4b7d298c2906a4ecf593bd3cdc4aacfd8d75ea1e8affa5fc55d1373498bea

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_e8fe9d077296525518f4508315de837b_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-xev4wab17k
SHA256 09d4b7d298c2906a4ecf593bd3cdc4aacfd8d75ea1e8affa5fc55d1373498bea
MD5 e8fe9d077296525518f4508315de837b
SHA1 12a3b9411a5964e1bc4e864b1251d930bfa1cbde
SHA512 727c646ac6dac0935d84418a6e3eef3d018c2e0dcd7144ad21b378cb584fd328a10ee0a30e5b9eb07d46bd9eb11392d7a2146e080178de8ffe4e9d3f44420a2b
SSDEEP 49152:4oa1tKC070EB8FksWDcPUyfBankuR7+Rt+vqfY:4oa1tKC0DikZD0Um4nT+Xa
TLSH
T105952210F795C2B2D4910671A5A1C3E6DCAA3E7C86009D83BBCC1B7F2998FD02A76757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6100	6A78.tmp

Executes dropped EXE 1 IoCs

pid	Process
6100	6A78.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_e8fe9d077296525518f4508315de837b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A78.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 6100	4596	2026-07-20_e8fe9d077296525518f4508315de837b_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_e8fe9d077296525518f4508315de837b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_e8fe9d077296525518f4508315de837b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Temp\6A78.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A78.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_e8fe9d077296525518f4508315de837b_amadey_elex_smoke-loader.exe C85CDD3A605AB4EAD04922485A53BEB05B2A2CD8AF9128AC4B0251696ED390801D98F93F25ECD1036913B0DD05408063032F4D72AB4B6168CFC9EC1EDD7CB027
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6A78.tmp

Path C:\Users\Admin\AppData\Local\Temp\6A78.tmp
Size 1.9MB
SHA256 b765437e3a17a84aae1edb54c2af4fa9dcade7fea47201339ed608ec75e18beb
MD5 6e8f37d1fab8482e27af9deb24599231
SHA1 db458487e7f5307a16304145d293e37f7ab9eb6c
SHA512 634bab2a9cfad6281fc0c2658f43b5cc8cf8a8639a22649b01c8f5020575dd598bf992f1aac6d4f59643412338d5cf868fb1c5adf0f7d45d381379a55a0c64d8
SSDEEP 49152:4oa1tKC070EOJ/BdkycF2mseUdJ42XqDJDuzK3CU5r:4oa1tKC0cGlIdJRXqDJKzK3t
TLSH
T154952210F785D2B2C4810671B592CBE299797EBD67429D473BCC1B7F28A0EC06A71B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4596-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6100-6-0x0000000000400000-0x00000000005E6000-memory.dmp