164c2f73cdc2556a2fe0c8f88f989b3cdfb2cec8c0c70cbf7f32e6af220c0dc4

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe
Size 3.3MB
Sample260722-hfpadsen21
SHA256 164c2f73cdc2556a2fe0c8f88f989b3cdfb2cec8c0c70cbf7f32e6af220c0dc4
MD5 4a3ace79086507667ac0ebf93fa9a093
SHA1 77eb8f9edc845945edfa3a59610ec0988ff24989
SHA512 28764c7436ed6013a489551c4368edc62bf502c7f25434bc31bce7bbdf135d9fbbb8bf0c4f352cd5a87f4128e7298850fe77d4a6e1a0d51ff56346cd1ebc97f3
SSDEEP 98304:QmSWOiIyUFCZUUFUUTRGLdVLUjH5oxFbxG:QX/CdFUUeVUjZEdG
TLSH
T1C1F52301B710B0F3D2416BF4749687D796703DBB7B1099C72EC8134E8CAA6D9AB67B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4864	E584.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E584.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4864	4340	2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Local\Temp\E584.tmp
  "C:\Users\Admin\AppData\Local\Temp\E584.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe D14493CC661979CAEE69A8A4182E45BCF94708997CE0536F46572A00361FF5CE213E1F35CE75AC3C9E799302D66BD0BB1C87C4FDAA88516D9BBF97CA608BBE8E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E584.tmp

Path C:\Users\Admin\AppData\Local\Temp\E584.tmp
Size 3.3MB
SHA256 959d154570bd1b494d7a395162f844e255111e347c597e3bf794322d514f01c7
MD5 08b6f0ab358f42c424d5c6121f1b6031
SHA1 d8c13ac000a8b5944dd393d8a261910a3a40b465
SHA512 45c0fd64893c9a93effb976ddf16eb8019e869295230cbf2e6cf2da82f63d1de4ce0955c29f494f914a214b11018315536bcbcc0b83da4da8205b43a6ba4ab7d
SSDEEP 98304:QmSWOiIyUjkjpZZoTvKVoq2PVLUjH5oxFbxG:QXJkjHT4PVUjZEdG
TLSH
T148F523017750B1F3C2426BF4748687D396306DBB7B51AAC71DC4234E8CAAAD8EB67B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download