873be88c5900706998f123c05ca34cc5ce1f6802900e4d62f407082923a109e1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_f78f21866d5f5ec6a7d8903b220e6cf9_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260728-aatzpadh53
SHA256 873be88c5900706998f123c05ca34cc5ce1f6802900e4d62f407082923a109e1
MD5 f78f21866d5f5ec6a7d8903b220e6cf9
SHA1 d66ec124a21f893345e0ef45b8034d3466e13440
SHA512 a0cec48aad54f6de58b7eafca0c8a262af7c39d20c8f6d7fca226213636420ef6d9eb0f011a97fb8d29461109ebf0772c797813105d4883ec080b6e0951e6303
SSDEEP 98304:emhd1Urye230O/CKD0lQZ4+EMh7sMwV7wQqZUha5jtSyZIUS:elWkx/+4ZGAMw2QbaZtlir
TLSH
T1AF56BF05DBE8EF1EC51F03B590B2222657FAD894E783AFD6A941F5B07E82350BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1292	3B2B.tmp

Executes dropped EXE 1 IoCs

pid	Process
1292	3B2B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_f78f21866d5f5ec6a7d8903b220e6cf9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B2B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1292	2548	2026-07-27_f78f21866d5f5ec6a7d8903b220e6cf9_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_f78f21866d5f5ec6a7d8903b220e6cf9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_f78f21866d5f5ec6a7d8903b220e6cf9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\3B2B.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B2B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_f78f21866d5f5ec6a7d8903b220e6cf9_amadey_elex_smoke-loader.exe A625337E870450FB68AE99DCD67C7421F0C9A831A23580AD2FD8C89145F9F66A59101B3FA020E86AD8ABA3D3E37B3C7300059D8CEF1CA67D53207CA0DD096753
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3B2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B2B.tmp
Size 6.0MB
SHA256 6c3169542bd5c7d5f0df305df0bee2f79650c52ac2de546fe0640b10dad96cc0
MD5 1a1e4358088635926ca45346b30ff91d
SHA1 c8f9701528b92e57e5a996ba72bf17bebc7e05be
SHA512 f2326b99f079d456b1b124fa5d168da99c2d8a532dc9f69ab61c41f363a1d3e1ae90785405be8d6311cc2557ca3f54f91e494a2935056e2719d452ca8381fe50
SSDEEP 98304:emhd1Urye30Mca1W300YI/V7wQqZUha5jtSyZIUS:elXE30Ja2QbaZtlir
TLSH
T1FA56BF05DBE8EF1EC91F03B590B2222657FAD894E783AFD6A941F5B07E82350BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1292-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2548-0-0x0000000000400000-0x0000000000849000-memory.dmp