4f34328acc6f11d01beb34f9b16d65c5f378c0deaa88dc1c5f5d5310aa851524

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260728-xmervsbc89
SHA256 4f34328acc6f11d01beb34f9b16d65c5f378c0deaa88dc1c5f5d5310aa851524
MD5 35ab8d2f377ecc1f03d0d306899457fd
SHA1 8b27bc864ab690b0edd7bdbaa3fed892e1cd01ef
SHA512 586bf1531fae7c6c2c1f9526ca3dd9d8bd256ad932c4328b6e86e5692decd0c5bb18698efb3aac6f725c44047dc5966f85d6bae96fabc3fa61035e784ad1b98a
SSDEEP 98304:emhd1UryesNqrctD7py0NVLUjH5oxFbxCVLUjH5oxFbx:elMNqrAFNVUjZEdCVUjZEd
TLSH
T1B9262350BBD5C361E18274F964D343DACA343F3C4676998B2FCA1A1EEC698E37275242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	E17D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E17D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2356	3716	2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\E17D.tmp
  "C:\Users\Admin\AppData\Local\Temp\E17D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe 78D2562D67630F6E9F1148A59880B604B9407F41A7F0039E42D1F9635143AF4F708EB28326CDFEFECE7B0598D73DA21FA6F7CB75C7748CEC26DA75EF288B7F83
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E17D.tmp

Path C:\Users\Admin\AppData\Local\Temp\E17D.tmp
Size 4.3MB
SHA256 83ebaa182ceb7dc8e43acbc9f2831f979c16b9671182c73eb9abcb3b4741db2c
MD5 f0aa117fbc40b205a9f50283ff2fcaec
SHA1 8e3b2962bbb77e4e6f09fd88495a391a8b9c9182
SHA512 3c3c843a3107893ec54f348bdd7c356998b198f013340bb8aff5d1aca211aa637d8243722a9fa1fc01e3961a3b86b6314109e3da398b9133934ad96f25fd5373
SSDEEP 98304:emhd1Urye5NbiGzYZExBE7rZVLUjH5oxFbxCVLUjH5oxFbx:elvBcP3ZVUjZEdCVUjZEd
TLSH
T1AD262340B7D4C261D1C235F9608343DAD9343F6D56769A4F6FCA2B2EECB88E27274252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3716-0-0x0000000000400000-0x0000000000849000-memory.dmp