165bfa7bd8dc95cec4d63126749d4992e2130d708cd0afa853084fa43b59ed5b

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_db013ff81979f0b00b42a07a36b62387_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260727-jps6dabl2y
SHA256 165bfa7bd8dc95cec4d63126749d4992e2130d708cd0afa853084fa43b59ed5b
MD5 db013ff81979f0b00b42a07a36b62387
SHA1 e2b31c4d17bb9ce57cbfbaba6125a0137d94af8e
SHA512 18509ad876ccb25b7f9d7f2708d502a33a8a6433a4e1666f4e44b737693844cad984bac5a382bba7ba5da1a777756242a815bf9a7eabf04cd5c4d55714ca0528
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dx478bhyD3v1F8NuJQVGTB8RfdZR+jAox2ape:Qoa1taC070dxZbOv1F8NuJH18RtyVpKN
TLSH
T1F7952361F7D5C2B2D0810571A161C7E2DC752EBCAA455C83BBD81BAF29A0FC0AF62717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3172	64CB.tmp

Executes dropped EXE 1 IoCs

pid	Process
3172	64CB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64CB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_db013ff81979f0b00b42a07a36b62387_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3172	1772	2026-07-27_db013ff81979f0b00b42a07a36b62387_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_db013ff81979f0b00b42a07a36b62387_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_db013ff81979f0b00b42a07a36b62387_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\64CB.tmp
  "C:\Users\Admin\AppData\Local\Temp\64CB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_db013ff81979f0b00b42a07a36b62387_amadey_elex_smoke-loader.exe 97EC57E5683D71F195F149DB746ED9B09C1004F986C6DE563CEE70D09F95AD99563714BEC1E23CF8CC43566C55D356F7A74928DEBBDAFD79A8A74BB25129F52C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64CB.tmp

Path C:\Users\Admin\AppData\Local\Temp\64CB.tmp
Size 1.9MB
SHA256 63e4afc6adbc770ba68ae856d1b3e3b415954d20ac6bbf28d2ecad290d1a4fce
MD5 aa1e0f2c01752c9db88adbc34ceb2e50
SHA1 a298140796867329d8f0d2c8d521df412fd029ec
SHA512 e2b07fdd59203bfe9d5e7f7e38ffec5f4dba5508970d833422359511e58aaaea728dd59f796c8cefebd850e4548d072eded7c5d2076ed16884d306c16c980945
SSDEEP 49152:Qoa1taC070dDgsoaWo423OouPY36IYSj6gJOa:Qoa1taC00Z53OrPIj6gx
TLSH
T1E3952215FB94C2B2C0810675A561C3E3A8787E7C5A059E4B3BDE0B7F2DA0EC09A76747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1772-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3172-6-0x0000000000400000-0x00000000005E6000-memory.dmp