b2b631141e4cbe4eab172a930ee5e9c58b6cc613970e2ca3105136e6ff5bd3a1

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_2890eecaafe61ab5d239b1f29b5f9db7_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260727-kkeymayzh1
SHA256 b2b631141e4cbe4eab172a930ee5e9c58b6cc613970e2ca3105136e6ff5bd3a1
MD5 2890eecaafe61ab5d239b1f29b5f9db7
SHA1 1a4e56b5a1bf30cacca5eddfcc62248ffe958107
SHA512 d8bc7b63d5b614b0834c95f0d409916fc72ac29bada340d7ebdcb0601aa122e975dc484d5f9ea720eb9690f550e00cbb203f9b9dd74cac5f2b7e92aa03bb8aab
SSDEEP 49152:4oa1tKC070E2gQlaJb6aUlJ9YC5ooP0BZ8sGN:4oa1tKC0RhJxcJWC5ooPc8B
TLSH
T1E3952255F780C2B2C0C20A71E6A1C7E289792E7D97458E837BDD1B7F2960BC16632B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4888	382D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4888	382D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_2890eecaafe61ab5d239b1f29b5f9db7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	382D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4888	3156	2026-07-27_2890eecaafe61ab5d239b1f29b5f9db7_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_2890eecaafe61ab5d239b1f29b5f9db7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_2890eecaafe61ab5d239b1f29b5f9db7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Users\Admin\AppData\Local\Temp\382D.tmp
  "C:\Users\Admin\AppData\Local\Temp\382D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_2890eecaafe61ab5d239b1f29b5f9db7_amadey_elex_smoke-loader.exe C23FD0C54A83420220AA3091EF02A5A7F9CF8C8478AC79CDC0C58460B5DF9E0124237111DE6E3139E621CA5B2CAB26E7C090FA022693A6B1DB0CC4DAEEF18724
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

382D.tmp

Path C:\Users\Admin\AppData\Local\Temp\382D.tmp
Size 1.9MB
SHA256 01b04a5731236148f2880301d691e463bc592b5aacc13478c801ec7715bd431c
MD5 9a24b9953f1736480faf786ee3926f14
SHA1 cea74d60e10422869c47b98b27ab9fdd509e2864
SHA512 829ab3f270eed957a18d378e28a74ca67bc53cd0ee2e308ffba891222745a617d338104c6a2e7c20e8433d91589073e974425b58a588ca184416bbe74c40d951
SSDEEP 49152:4oa1tKC070E5XYe3ejySuyy1wj5GmbQM:4oa1tKC0/ZhSj5Gmr
TLSH
T11A952350FB84C2F1C4811931A6A1C7E2D9793E7D46459C837FC81A3F2AA4FC0AA76B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3156-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4888-6-0x0000000000400000-0x00000000005E6000-memory.dmp