01e44b98b598d745551233e209bea5a87828bef140137aaed173bd80775bd2dd

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 21:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_130913880e6b619f30d59fba7c27c3d7_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260722-1aczaace69
SHA256 01e44b98b598d745551233e209bea5a87828bef140137aaed173bd80775bd2dd
MD5 130913880e6b619f30d59fba7c27c3d7
SHA1 9929ea81ece388f58547a0b209a589e82ab5da23
SHA512 2bdfdcf814c2b12eff720f05c37629d91826fe0d7d3aa99fdf99e8d91fb26f80e7b318c552739c4dfc4a7e5914436f7f239c48875c92a69b6baebf24ecd9a99a
SSDEEP 98304:Cmhd1UryexAOXg7ilarT9BaaVLUjH5oxFbx:ClRAOQulS9BaaVUjZEd
TLSH
T1F1262351F795C2B1D0C165F8A08283DADD303E7C6656AA872FCE232EDC789F16679243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
120	3C25.tmp

Executes dropped EXE 1 IoCs

pid	Process
120	3C25.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_130913880e6b619f30d59fba7c27c3d7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3C25.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 120	4324	2026-07-22_130913880e6b619f30d59fba7c27c3d7_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_130913880e6b619f30d59fba7c27c3d7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_130913880e6b619f30d59fba7c27c3d7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\3C25.tmp
  "C:\Users\Admin\AppData\Local\Temp\3C25.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-22_130913880e6b619f30d59fba7c27c3d7_amadey_elex_smoke-loader.exe A71DDC134105BDCF60DE6029532C621E41763D5BBC35EF978C2341F0BA4F9F414178ED84160E48C30D0596FF8D42A831906B446F9941A45D96FAA765074CCFBE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3C25.tmp

Path C:\Users\Admin\AppData\Local\Temp\3C25.tmp
Size 4.2MB
SHA256 3a7c6b86703f14250c45711a63571ccab1c1358ca255e332450cf9623a7f9c20
MD5 076da411d4ca985a33123310ab8a3626
SHA1 9a9a80a85be997d52c31ba8ebcbad72a4cd98b00
SHA512 89e368b05aa714360970bdd0c5d90a1faa00dbfe50af2ed8ec0839048f0c13bc820c55f8f0dec4588f383ef9d6e24d6e341b83d798446e0a5cb0b774622918fb
SSDEEP 49152:+vm2AC0d1XqrdryeJVsvq5aKtqUK7BmUSAAnZ8zUBwLVT5kUvgJSgHT6ojkxFbxz:Cmhd1UryegFdUAtFzRVLUjH5oxFbx
TLSH
T130262351BBD4C372D08165F935C383DA99343EBD4656998B3FCA2B1EACA88F16734243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4324-0-0x0000000000400000-0x0000000000849000-memory.dmp