d22e5112ebdc1d644e838f849ee443f725b68532761bf3480c923d28127a224d

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_f81bb1da86386cacf7ecbcc2a9f5c0bc_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260722-sq511age45
SHA256 d22e5112ebdc1d644e838f849ee443f725b68532761bf3480c923d28127a224d
MD5 f81bb1da86386cacf7ecbcc2a9f5c0bc
SHA1 777525d870b6f6f8691f90513ea2d12469ebbaa1
SHA512 b48cdf80916fd127adae9d05661c8c680e168d63516d0252de9b4e2759b09e6235198358f09ac46337f67aab0d4e0274e9e2745d116ea4726b33df152a63caaf
SSDEEP 49152:Fvm22OdWOXqrbIyUJG6cnsQ6VD0cWVQv1Dxz0HLVRwLVT5kUvgJSgHT6ojkxFbxx:5mSWOiIyU9giWVkB0rgVLUjH5oxFbxx
TLSH
T150E52340BBD5C2B2C08221F9658343DB95743F7D5516998B3FCD2A2E9CB89F6A634383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3272	5CDC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_f81bb1da86386cacf7ecbcc2a9f5c0bc_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5CDC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 3272	3348	2026-07-22_f81bb1da86386cacf7ecbcc2a9f5c0bc_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_f81bb1da86386cacf7ecbcc2a9f5c0bc_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_f81bb1da86386cacf7ecbcc2a9f5c0bc_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\5CDC.tmp
  "C:\Users\Admin\AppData\Local\Temp\5CDC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-22_f81bb1da86386cacf7ecbcc2a9f5c0bc_amadey_elex_smoke-loader.exe 7CC126D48C9781376DCE4600422E444B9B8465973A012C557154CB9AF64E3B63316ADBAD069925FB3B80363F6B2E0630B1304FDC878E96CA996D4541B93566BA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5CDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\5CDC.tmp
Size 3.1MB
SHA256 3f952fdbf92371ccff40d46dd87d645a010b7722d2f6c2a275120f6173854841
MD5 2e8780c2cceaf1e593d9f194a4b60be3
SHA1 a598d3827293298b4102b4cad48b03783497edd0
SHA512 f14bdbbf114983e12b54fa55e79ba83c00a116e4cf8d3312f268fe0eaf81016d15c2e0eef86b14a32159cedd1b1a8330c3ec505c1682b9681460d44b313b8ff9
SSDEEP 98304:5mSWOiIyUlF3y9v3ZvBYz5VLUjH5oxFbxx:5XzF3yTvBwVUjZEdx
TLSH
T1F3E52340B7D2C372D08124F9658383DAD8783E7D66259D8B3FCD2A6EAC749F16279243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3272-6-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/3348-0-0x0000000000400000-0x000000000071F000-memory.dmp