28eb69c7968c0f50cb25f18652ec79e73a9b3dbf6e926d9fa40b9494c679d8dc

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 13:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_011405c3f6e0bf9cf7e5fa64a46424b1_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260723-qb1fvsdj71
SHA256 28eb69c7968c0f50cb25f18652ec79e73a9b3dbf6e926d9fa40b9494c679d8dc
MD5 011405c3f6e0bf9cf7e5fa64a46424b1
SHA1 44eb010f6422062a0b48a308dc62411a5ba25e66
SHA512 718c6f4777fae0e8d4db8495e6feac32f4f4b2548a619593c3b1d85d088906f3f93320308e9bd09392d6cab2ffcf3522fa1259834245b6e9b4e458f0d04b562a
SSDEEP 49152:toa1taC070U/lddv881iX2UzN2+Uts4RUvgypjw+T:toa1taC0lh88SzUtsoOwK
TLSH
T185952251F791C2B1D4914930B6A2C3E7D8693EBC56459C83BBCC2A3F6CA4EC0663275B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4964	FC1E.tmp

Executes dropped EXE 1 IoCs

pid	Process
4964	FC1E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_011405c3f6e0bf9cf7e5fa64a46424b1_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC1E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 4964	5420	2026-07-23_011405c3f6e0bf9cf7e5fa64a46424b1_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_011405c3f6e0bf9cf7e5fa64a46424b1_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_011405c3f6e0bf9cf7e5fa64a46424b1_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Users\Admin\AppData\Local\Temp\FC1E.tmp
  "C:\Users\Admin\AppData\Local\Temp\FC1E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-23_011405c3f6e0bf9cf7e5fa64a46424b1_amadey_elex_smoke-loader.exe BD84D45D8F5666960A497ED40F6912E6C1850C04723D6D3C8B31E00831998CC0B08BF81C03B8177FF6E9E996337767CA776889D36D3B59BEEDB386913D3E4D1C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FC1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\FC1E.tmp
Size 1.9MB
SHA256 16bf40cbc2c6087ba80b8532c7dbae61e4fc4aa11dbee76a4b28d0494775e867
MD5 48b8e86c1101d7aa94e9b833b45c75a7
SHA1 c90ac87a1553f349b267102d4735573b13fea494
SHA512 777d2d10f2471b3386123eef3cd362f03677ca932cb28480c46577e52ca9ddb28708e6a8f168b4c1f65ecfe7866803eb8fcd0dbe628c4572577100c473383189
SSDEEP 49152:toa1taC070U4jpdeX2VR5RcfIr2m/LG6B2Qn:toa1taC0GpPvcfgJ/L8
TLSH
T175952350E6D5C1B2C0D11735B5A2C7A2EC753DBEA7109C83BBC8277F29E4EC46962A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4964-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5420-0-0x0000000000400000-0x00000000005E6000-memory.dmp