6e8c567694aff2ad85cb1ae47e7bcc857e0d5a8e654d8ce45a3868de90425708

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_0767c3303659970d868b467d8b7fa6c6_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260723-qbb39sba89
SHA256 6e8c567694aff2ad85cb1ae47e7bcc857e0d5a8e654d8ce45a3868de90425708
MD5 0767c3303659970d868b467d8b7fa6c6
SHA1 b554a2e7fed27b6449c9237cbd06aa91976cb57c
SHA512 e8a9435c05461b16054241f3b285886d5e1a29650ab83b3633e7a4e5bb02063b8430d2075ee87fe964124220babccc75c3ed182cb8f73e8a38d77f3bcb482f94
SSDEEP 49152:ioa1taC070UWiP+G99CqbiPXZ8ka3gTH7Giy0Trdf3QvOJFIRU:ioa1taC0nP+GbiPXra3TMZ3
TLSH
T18EA50200B710F0F3C1156BB0659AEB5FB53069FB3B45CC877884679B19DBAC8A712B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3296	141B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3296	141B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	141B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_0767c3303659970d868b467d8b7fa6c6_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 3296	2592	2026-07-23_0767c3303659970d868b467d8b7fa6c6_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_0767c3303659970d868b467d8b7fa6c6_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_0767c3303659970d868b467d8b7fa6c6_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\141B.tmp
  "C:\Users\Admin\AppData\Local\Temp\141B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-23_0767c3303659970d868b467d8b7fa6c6_amadey_elex_smoke-loader.exe C18E3E79F837FD0D185C4148A463D459646565AFD0AB9321162A0F34457FC2650DD5E9239246FAB2F2795220562020958ADE3AC01CC688AD14D5F294D5204D18
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

141B.tmp

Path C:\Users\Admin\AppData\Local\Temp\141B.tmp
Size 2.2MB
SHA256 18566bc0d9baf1dc9c328589b09be6dff6b6cd304dfb441a3874d59d9991b39c
MD5 d686a1f1d75b6c18cf29d4508b50cdd3
SHA1 0f40ba8d22ecc70a3469f111370641b7295c300d
SHA512 fcaa33211b202632e00f927d0b0f00c31d5d7eecddc51b0751bdf9a6c4a656f91e01aa8445ccd92668375373c762ecf066680a0f1866df28e28eb49034ae5328
SSDEEP 49152:ioa1taC070UUmPzY4kv6HUlcoDPbSl60QvOJFIRU:ioa1taC0ymPzvkgUlcoD2lD
TLSH
T14CA50100B700F0F3C5056BB0665ADB9F667039FB3745DC877988279A19DBAC89712F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download