f2501f4e881406d01bfe4c3d6d3f4c4e9f74539fc0245a3d92ecf0e158ac94fc

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_74af722cc9ffcb01ce7d2df08e8bc0d5_amadey_elex_smoke-loader.exe
Size 2.4MB
Sample260727-yth9as1vgv
SHA256 f2501f4e881406d01bfe4c3d6d3f4c4e9f74539fc0245a3d92ecf0e158ac94fc
MD5 74af722cc9ffcb01ce7d2df08e8bc0d5
SHA1 da3ea9b9728974f5cbc3feba2a0e9e9b0a160c8a
SHA512 451dc20e10337771ae318c3eae08a2fb4394d9c5e1722238bd29907c60b0266f2b0d9bce19207eb20551d266bcd12befc7503a6ab3cb90d735f9cdef99300519
SSDEEP 49152:Zoa1taC070Uu4uSWJmRZU72MWjeJNuxkbixZ:Zoa1taC0A4uBJm3FMWjOigy
TLSH
T1B4C5CE13E78159E6C3C90135EE10C161972AF42DABFB0672798C12DDEF53786BF21A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5036	352F.tmp

Executes dropped EXE 1 IoCs

pid	Process
5036	352F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_74af722cc9ffcb01ce7d2df08e8bc0d5_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	352F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 5036	4376	2026-07-27_74af722cc9ffcb01ce7d2df08e8bc0d5_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_74af722cc9ffcb01ce7d2df08e8bc0d5_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_74af722cc9ffcb01ce7d2df08e8bc0d5_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\352F.tmp
  "C:\Users\Admin\AppData\Local\Temp\352F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_74af722cc9ffcb01ce7d2df08e8bc0d5_amadey_elex_smoke-loader.exe 9EE480646B5F3D93EF2BD01D6F31DE9466A06B3245ABD297740918BF9B90A73A9AB4BA9BEECF38411C08279F94190F8E449F74CF8842AA2641A78EFAEBBCA718
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

352F.tmp

Path C:\Users\Admin\AppData\Local\Temp\352F.tmp
Size 2.4MB
SHA256 51fae66ed746923c6b803b2568267950b09e1b88983c42ec326886f5868e4329
MD5 d30ea7160b41309faae83fd17a4bd247
SHA1 e6519757a0131dbf3a3e8a8566f22bc6e03a6ad7
SHA512 28108a8d5822350f660edaeacea56165c164dc32fa88b092317f373705b7dc7d721ce968c8d7d92d26ba57e13f3a96eab45ca98c9679737e472d0152d1da946c
SSDEEP 49152:Zoa1taC070Ux2+9hIr98LrvmJzapmzeXaFBReLBg:Zoa1taC0j9qreLdmI
TLSH
T19FC5CE03E78149E6C7C94175DE10C261972AF42DABFB0672794C12CDEF43786BF62A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download