c180b032100283e7d503a51cecd7e8fb25f7dba50e81c87f62eaacf38f0c2b32

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_786d26e93aae0274fcfc619c2337230e_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260721-vnd6ls1drd
SHA256 c180b032100283e7d503a51cecd7e8fb25f7dba50e81c87f62eaacf38f0c2b32
MD5 786d26e93aae0274fcfc619c2337230e
SHA1 cd2c21c935f2b6ff9910664219a7453c7f7ebaba
SHA512 3e3b4dadd3f77a8917697c401c20cdd7913173e3059a0081418970cb17bef8afbf3f3a814b386af3348c0db6a2edcb3884ece7e53ea8c93c2a85b06a4fa35c83
SSDEEP 98304:emhd1UryeFeatUy3EQOWltUCLV7wQqZUha5jtV:elfth1pltUCL2QbaZtV
TLSH
T1E626C00896FCD92DD82F52F4A1641185C7F0A564E7D3AF997DA2F1F02A823B4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6020	818A.tmp

Executes dropped EXE 1 IoCs

pid	Process
6020	818A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_786d26e93aae0274fcfc619c2337230e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	818A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 6020	3140	2026-07-21_786d26e93aae0274fcfc619c2337230e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_786d26e93aae0274fcfc619c2337230e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_786d26e93aae0274fcfc619c2337230e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\818A.tmp
  "C:\Users\Admin\AppData\Local\Temp\818A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_786d26e93aae0274fcfc619c2337230e_amadey_elex_smoke-loader.exe 1FEF8AA06BF7FE71DC84D20D34E54EBDB48AFA780427B09723990F2B34F4B0726470240EC14BBCE06174F9853876B64FFD9DED5DC7BB63B1CA1B97C9B739E7D2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

818A.tmp

Path C:\Users\Admin\AppData\Local\Temp\818A.tmp
Size 4.3MB
SHA256 548ae24574c16590b671fcdca6602b66d6934a93e19a6b9adc5b2f81fef2d193
MD5 6e59e9cf0ff53d8f192a211f9095904c
SHA1 77660a5b101048f98004a1d6ea30fa9ffb5ccb46
SHA512 e46b2eb8bc51071639a83b3f34a6a1a270fc330e82c585949de8b3ad8cb794f6e0903d0315ae5b5b628015688a3cebf06a60eaaf27c0a7eabe9fda28cf52abf4
SSDEEP 98304:emhd1UryetiNxDpZfTfbSiqX6aV7wQqZUha5jtV:elNSt7jZQ2QbaZtV
TLSH
T11526CF0896FCD92DDC2F52F4A1641185C7F0A564E7D3AF997DA2F1F02A823A4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3140-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6020-6-0x0000000000400000-0x0000000000849000-memory.dmp