993198642d8db1a47a5f38881298c46430d5e7a6df9ad118ee01bd8525efb6b1

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_a6e03d4346d3e8028cc5495897a3ff1f_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260724-l5xjvacj21
SHA256 993198642d8db1a47a5f38881298c46430d5e7a6df9ad118ee01bd8525efb6b1
MD5 a6e03d4346d3e8028cc5495897a3ff1f
SHA1 f895a91dbd2aa0b5d9387b838ff49b9a76e30b54
SHA512 06d71f10183ee4e9902984e49148d8347be42a8cdfe75639c34c1a8dc1f797fae8afa2d8419dadef02ac77b6393496563fdf9834a65ccddec9b50d4803e036d0
SSDEEP 49152:Qoa1taC070diALH2gInxblupuXV9O8nsTQezKkHjM:Qoa1taC0NAj2gWlupMV9OQuTDM
TLSH
T19E9522A0F380C1B2D0424A70B252C7F2D8B93D7D9B459D87BFD92A3E1960EC46A71B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5028	1207.tmp

Executes dropped EXE 1 IoCs

pid	Process
5028	1207.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_a6e03d4346d3e8028cc5495897a3ff1f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1207.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 5028	3948	2026-07-24_a6e03d4346d3e8028cc5495897a3ff1f_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-24_a6e03d4346d3e8028cc5495897a3ff1f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_a6e03d4346d3e8028cc5495897a3ff1f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\1207.tmp
  "C:\Users\Admin\AppData\Local\Temp\1207.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-24_a6e03d4346d3e8028cc5495897a3ff1f_amadey_elex_smoke-loader.exe 719B78118D9289C3B68C73E8C3B6193242CE881859D9AE793A96546F817FF4C877FE727FE3335CAE7985B0F16BF32CF2C0E96839F928045C462CF0D351F55D86
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1207.tmp

Path C:\Users\Admin\AppData\Local\Temp\1207.tmp
Size 1.9MB
SHA256 5d72f84ed03f5d8c46bf3558bf6f605bc91893af9bc0e4f1c5024b2522d53540
MD5 3196891e58a3a58703ae3d674dbc6bfd
SHA1 913137de546144ec60bd4fd020843538a8996f9f
SHA512 589aff79276c6854c9de60d8309997e6bfbd4cd45a09270c209043db968e5dc20c05cccf55a07eb1b05e493babf8e64c2bd9545fef9f608d54454a369c90abda
SSDEEP 49152:Qoa1taC070dWdROmCQ90vcnqEjPBf8tn9Q:Qoa1taC0xdxP90vcnbBf2q
TLSH
T165952261FB94C2B6C4810535F562C3E6D9793E7E47059C43ABCC2A7F6AA0FC06671A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3948-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5028-6-0x0000000000400000-0x00000000005E6000-memory.dmp