b26c1f945e26189ef1d02531ab293993fba11e9e50ca544e65d380300f19d902

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_0177f737de80038d5eb0a10f7dbd0ced_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-ylbt9afs91
SHA256 b26c1f945e26189ef1d02531ab293993fba11e9e50ca544e65d380300f19d902
MD5 0177f737de80038d5eb0a10f7dbd0ced
SHA1 02d3c52b056c2b0df91d6d0b58c90ea06f8611d2
SHA512 900c8c25e88d9cb1ecd02e473304b8316b205c065d4070e8ae1351bd7960c30a198299bdecc483f3e0470c2178014d16f6f3869828467f87280711be3fcc1f47
SSDEEP 49152:Qoa1taC070dvv3C1S18R2dBlZKs4huQSxVni77zQ:Qoa1taC0QcSnBlZKcLxVi7o
TLSH
T1459523A1E798C3B2C0910671F591C7F6C8643EBD66458C877BC82B3F2DA4ED1A63161B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3336	4AAB.tmp

Executes dropped EXE 1 IoCs

pid	Process
3336	4AAB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_0177f737de80038d5eb0a10f7dbd0ced_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4AAB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3336	4696	2026-07-20_0177f737de80038d5eb0a10f7dbd0ced_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_0177f737de80038d5eb0a10f7dbd0ced_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_0177f737de80038d5eb0a10f7dbd0ced_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\4AAB.tmp
  "C:\Users\Admin\AppData\Local\Temp\4AAB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_0177f737de80038d5eb0a10f7dbd0ced_amadey_elex_smoke-loader.exe 741267080678F64C79690ABB203AACCFF82760276AD81344F3D854AEC7A9CD8C6C7DD95B7FF0BC5051BFFAC2770D779F367F7BFBA1A883234AA0CE0C85A69F4D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4AAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\4AAB.tmp
Size 1.9MB
SHA256 8202d52bfd20b15f10c77320898798614813e4f439f34b5b21691aa16ca5ee27
MD5 812d6d006db6cb118317720b6ba40f83
SHA1 aa8ef2c3387c78ee533e642fb65c562bf0116747
SHA512 d551ef7bd2964d2c83092c4e281703f5204ab354b2a32e6787b7435499338493bbed0709d0e12b1f2d7ea31c0c9386e6915cfdc1d9958435c621b48792136cf2
SSDEEP 49152:Qoa1taC070dLBIrhxuuGG/z+W8mL3rVJJmO68:Qoa1taC0qihy2JvTr302
TLSH
T188952314EB95C2F2C09606B1A5A2C3E6E8B53E7C57418D43BFC91A6F1DA0ED06B32747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3336-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4696-0-0x0000000000400000-0x00000000005E6000-memory.dmp