40f1df1283b9149f1670e8f93771f4b0a88a83fc0b442757718b5d2fedb83412

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260721-22kzmsgb82
SHA256 40f1df1283b9149f1670e8f93771f4b0a88a83fc0b442757718b5d2fedb83412
MD5 8bc783d5b76f145c445c0a5124aca4e1
SHA1 b717c2245188b16e21291ea83be7524327dff00c
SHA512 d00bad31fb3b56289b62a2c4adceb7239c042f5f5cc0f2c3fd2f057bf989f1e71e933e0facffef59343696ba8cad82664a424339c31b7a056606b8805cfb3a9e
SSDEEP 49152:boa1taC070UGTLoG0Cxh+ATR18f2TTHH:boa1taC06LBh+wRufqD
TLSH
T10D951251FBC6C2B2C4825971A552C3E2DC6A3E7C27429C83BFD81A7F1960FC46A65B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1656	DE7F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1656	DE7F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DE7F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1656	3288	2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Users\Admin\AppData\Local\Temp\DE7F.tmp
  "C:\Users\Admin\AppData\Local\Temp\DE7F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe 3860A032204D16F54AF2164CBF580C3CD282D253AAE51DB4A0DA1A7A5E45510F380427628501C95170584BB0620FB448A5B7A094500B4B560BB8B10FDDC3BD52
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DE7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\DE7F.tmp
Size 1.9MB
SHA256 2ead9d158f06a18876efa6bdcd28557203734978fd5f97158ba197deab9eb4da
MD5 fe7b9c64000aaaccf815337751e46f74
SHA1 822351167b472bbbce5b472bd32e261d89d45041
SHA512 05ba568f567abf1efe978930afa1cc3e5283253339475984147b383c90046687fcedfc4bd16462e6737f1b00b5fd5be3fd009a90f6d52ae80d6c7389305dd210
SSDEEP 49152:boa1taC070UCoqunwGWd6tSyN+7ykznFtOaH:boa1taC09nwGs6tSy07TFt/
TLSH
T1AC952361F7D5D3B1C0811A72A292C7A6DE293E7907429C87BBDC1B3F2C64EC15A22717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1656-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3288-0-0x0000000000400000-0x00000000005EB000-memory.dmp