7acb9d5376c667c9ff1b1d31f27779ec8f13928038d865679f7c540eca9f7b94

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_5ab5306e8f61b118493e3eea0912023a_amadey_elex_smoke-loader.exe
Size 2.1MB
Sample260727-kcazpsygla
SHA256 7acb9d5376c667c9ff1b1d31f27779ec8f13928038d865679f7c540eca9f7b94
MD5 5ab5306e8f61b118493e3eea0912023a
SHA1 549a6b0d0c7fef274c152c70ab2ca105f8b7596a
SHA512 b2ed3b806a2da10a2be1ea075136ffa3496f3c9c1c97659dcba50404125cc0e935add83b093ed3ac8990a73cffcce8be4d2d80e2da37751bc2c336862fa675c3
SSDEEP 49152:ioa1taC070UWox7KEeJDToZYwDMKWJ3vOJFI+3vOJFIb:ioa1taC01VEoSwD37
TLSH
T12DA50201B71070F3C614ABB0A5999B97A6606CBB7B41ECC77984535F0DCBAC8AB13F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2556	4099.tmp

Executes dropped EXE 1 IoCs

pid	Process
2556	4099.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_5ab5306e8f61b118493e3eea0912023a_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4099.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 2556	472	2026-07-27_5ab5306e8f61b118493e3eea0912023a_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_5ab5306e8f61b118493e3eea0912023a_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_5ab5306e8f61b118493e3eea0912023a_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:472
- C:\Users\Admin\AppData\Local\Temp\4099.tmp
  "C:\Users\Admin\AppData\Local\Temp\4099.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_5ab5306e8f61b118493e3eea0912023a_amadey_elex_smoke-loader.exe 126FDAD84F36CA3339A8E4A087281B2E80E80EAFED910CEBB1F75271350AEEF045D99C509401E1A6F2A77982900C32AD691DA584DEBB7EBE2393623D123105DF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4099.tmp

Path C:\Users\Admin\AppData\Local\Temp\4099.tmp
Size 2.1MB
SHA256 bee3c80ec1d022232af115b1176530382f8bdb3b43548714c9b618c9852b551c
MD5 655bdbe82fb9dbe1db67c74f0e286add
SHA1 c79b4c1c9b27d0b989d6704e70025345799ebca0
SHA512 d409d283877c4b7abb91782b2b604ab3d10b41d27ba77af907e7be54e099ef3a3b950e99b8981fe6c10d940cd783d1749583e22d53704993bcc442026304bf82
SSDEEP 49152:ioa1taC070UAx41QIwMd51ZezFu/43vOJFI+3vOJFIb:ioa1taC0exa9jd5SzFsZ
TLSH
T122A50100B70474F3C6156B70A599AB93A7206CBB7B01ECC76884579E0DDBAC89F17F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download