eefb0ca6e22a34e4b30eddd09cc4dbc796674a8c5dfd18011568f438db2cc611

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_9bc44435627f455d342ee527410542c0_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-xr55lsd17x
SHA256 eefb0ca6e22a34e4b30eddd09cc4dbc796674a8c5dfd18011568f438db2cc611
MD5 9bc44435627f455d342ee527410542c0
SHA1 76e653a58948692b4636dfee74178c366b0150ba
SHA512 648bce54329e81f12f52814e5b3e703063449a64f75d2c7665adb75c9df63f83c1a232b2bf9a33b40d26a1b6179a42caf2a64ae6ec479c62bddb895f5fbfaf54
SSDEEP 49152:+oa1taC070UseaozPYoDK6ZMKZN9plhKSCp:+oa1taC0Ta2PPe6ZM+plh
TLSH
T173952210F794C2F2C0920675A681C7E6D8797D7D9B458D83BBC81E7F1AA0FD02926B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1768	D632.tmp

Executes dropped EXE 1 IoCs

pid	Process
1768	D632.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D632.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_9bc44435627f455d342ee527410542c0_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1768	5056	2026-07-20_9bc44435627f455d342ee527410542c0_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_9bc44435627f455d342ee527410542c0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_9bc44435627f455d342ee527410542c0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\D632.tmp
  "C:\Users\Admin\AppData\Local\Temp\D632.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_9bc44435627f455d342ee527410542c0_amadey_elex_smoke-loader.exe 34C9DF7FDF2DAC6A9B3F6768D84BEE6E6955D01B37CF392D2C4091775584CD536D55BA85CE4BCD970CB186E63B719CC74F25314E9F8EA80225D20EDE558A9322
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D632.tmp

Path C:\Users\Admin\AppData\Local\Temp\D632.tmp
Size 1.9MB
SHA256 62f874d6a49eae3c8ccba3bfcafc63505ba6e31e8d3800bfc8681f29d98dd136
MD5 e6902d9ebe97348f01e68c9181c8e278
SHA1 18674645e0549e19006a63d12d987ba5ce82800a
SHA512 dbe90776bca3c205ebc26a6d7744ccd1d185f5b690fa56d4c98f96bf243388c4c996da8b83ad9f115b71271da1e1ed3bef792ca4222b08b9d63e933dc686ac1d
SSDEEP 49152:+oa1taC070Uq3621gnnil+UC1u5n9CiC:+oa1taC0I3MiMNI9Ci
TLSH
T16C952350F791C2B6C0810A76A652C3E7E8693EBC57558C837BCD1A3F2994ED06BB2707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5056-0-0x0000000000400000-0x00000000005EB000-memory.dmp