ec1c52048b56456868dea2b9e8c3d15ae3ad3181c4df074136f2eaf31c606ad4

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8f96063ba5c4427167cf6922df601c3b_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260727-hakd9aam4y
SHA256 ec1c52048b56456868dea2b9e8c3d15ae3ad3181c4df074136f2eaf31c606ad4
MD5 8f96063ba5c4427167cf6922df601c3b
SHA1 e52dd47d152ddc8c2d6e4c45b5f719b91614315e
SHA512 2ac1aaf7c3eef91ff285ee059957852fdd05a3d938f04506f8e1c407a3c1fed820ea4c92b6ae5676df140109bdb462b4178657addc9573d2000e4ee5ddb2c221
SSDEEP 98304:emhd1UryeHZ/sV6quYv9yWzGVLUjH5oxFbxCVLUjH5oxFbx:elZEx9yWaVUjZEdCVUjZEd
TLSH
T120262350B794C262D1C274F9A08383DFDA383F3D5676994F1FCA2A2DDC685E27278252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4704	7805.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8f96063ba5c4427167cf6922df601c3b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7805.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6844 wrote to memory of 4704	6844	2026-07-27_8f96063ba5c4427167cf6922df601c3b_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8f96063ba5c4427167cf6922df601c3b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8f96063ba5c4427167cf6922df601c3b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6844
- C:\Users\Admin\AppData\Local\Temp\7805.tmp
  "C:\Users\Admin\AppData\Local\Temp\7805.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_8f96063ba5c4427167cf6922df601c3b_amadey_elex_smoke-loader.exe C9D96BD4F6C260691772D711CB3ECEDD8C3D0BFC8F854C633E11E6727A3A4CD5E88DF4A272B411119101538D44DFC9333E87B1A5A228F9EF2FB9EBEE1CF3C4B0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7805.tmp

Path C:\Users\Admin\AppData\Local\Temp\7805.tmp
Size 4.2MB
SHA256 fc0d0bef58f23fba0c11c76466b98be2e92fe2e3e1d3ed5d6b369b0a44a1d77a
MD5 571cbfcd5815061e6e0e27bbb149016f
SHA1 aab7cc5f7cef35b42d3036919ca3d442d62c4873
SHA512 7b89c6b72b14502cf05547826637cff70099a4a6df62f61d1cc8ce8b44afe2415dc3ed51af4514b645e9b417389b7ff865ace050be09a57639910d46688dc07f
SSDEEP 98304:emhd1UryegykBYYepVVLUjH5oxFbxCVLUjH5oxFbx:elAy7zVUjZEdCVUjZEd
TLSH
T1AA263341B794C3A1E1C279F964C343DAD9743F7D462AD94B6FC92A2EDC788E13238242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4704-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6844-0-0x0000000000400000-0x0000000000849000-memory.dmp