888b91b7a5d443e1c3032907762568f9ac207addac9bcd44063cc477d21c259f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_e8999be97822068555e923377d208c6d_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260727-jmc2daysbv
SHA256 888b91b7a5d443e1c3032907762568f9ac207addac9bcd44063cc477d21c259f
MD5 e8999be97822068555e923377d208c6d
SHA1 e81c5b0ec149f12e3134ebf66ec41ae22667586e
SHA512 9090757f1199ace12576fcb23d9d5141a4d5ae648be592f4c810e5d6928e482ebaf9e62fb3068aa16fdbe934525354862e92af6f705ad6e16fe4ae0d9f78d334
SSDEEP 49152:Qoa1taC070daiAzvv7zXyagEKxXHjKXSs/1VJ:Qoa1taC0jLvvXyagNxXHjT0
TLSH
T139952214F7D5C2B1C08116B5E552C3E69D693E786A819D87BFC81B3F29A0FC06A36B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3352	3BF6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3352	3BF6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_e8999be97822068555e923377d208c6d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3BF6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3352	1632	2026-07-27_e8999be97822068555e923377d208c6d_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e8999be97822068555e923377d208c6d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e8999be97822068555e923377d208c6d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\3BF6.tmp
  "C:\Users\Admin\AppData\Local\Temp\3BF6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_e8999be97822068555e923377d208c6d_amadey_elex_smoke-loader.exe C4D01133E0AFDF7A93D3620CD2EA3D2C5AA22DE66C6572824D009E0E1890878E159EF19CF37FD73924C36F150C648E11051FAF03C7B8345EC31E1F321EAD5EBC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3BF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\3BF6.tmp
Size 1.9MB
SHA256 7a0362200c111d5d4648f2fb92c017a6a2a39e9dee71d5f33cd4160071824c9b
MD5 b11339ef9bc2457a20b0f0ffbe489fde
SHA1 3d6f1b1cef0a7a9b8d27eae5cd0ac06a8138ed5c
SHA512 e18add72df9283d8346d6ba465b40b19925e94c0c01802522d4a02bd19e6e1a10e7e6c51f9ca9498b29ae546186aa44bcfe5dd4f37d7efe5da1c8c6bba03eba2
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dysY11ZLrGqiSlmPTj4c7Ha7DJrvhrISBhZ6A:Qoa1taC070dysG1NyqAkaHsISLsRZE28
TLSH
T168952351F799C2B2C8850235A1A1C3E2EC797D7D52468C837FCC5B7F29A0AC06A76B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1632-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3352-6-0x0000000000400000-0x00000000005E6000-memory.dmp