53ab530cb9b33e2e98c93106ac354673687b63261e973a04b8a6b096b531c376

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_099ec88e7e0a945d4c6395e43e3d190b_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260729-1brttsfb52
SHA256 53ab530cb9b33e2e98c93106ac354673687b63261e973a04b8a6b096b531c376
MD5 099ec88e7e0a945d4c6395e43e3d190b
SHA1 ac7f371b11f68af52be3a757aa0d6c6b86a41c87
SHA512 c6c24bd3af30bdec9ce20b691a0cead1b8bc46a0632895837fb46b9b119a0b50800985f0a935e8a4dea659b8e2525d57da1a6fec11aecde70e23829b20600801
SSDEEP 98304:emhd1UryebU8MA5y/7B2RD6VLUjH5oxFbxCVLUjH5oxFbx:el77xYV+6VUjZEdCVUjZEd
TLSH
T134262341BBD5C361D1C279F9A48343CAC9343F2D5666D94F3FCA2A1DECA89E27274242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2772	65F4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_099ec88e7e0a945d4c6395e43e3d190b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65F4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2772	4600	2026-07-29_099ec88e7e0a945d4c6395e43e3d190b_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_099ec88e7e0a945d4c6395e43e3d190b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_099ec88e7e0a945d4c6395e43e3d190b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Users\Admin\AppData\Local\Temp\65F4.tmp
  "C:\Users\Admin\AppData\Local\Temp\65F4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_099ec88e7e0a945d4c6395e43e3d190b_amadey_elex_smoke-loader.exe 91553CF222D02073214CD0C8821095FB2F7CE35F850E185DA64AB06F8CDC9ADF24FD90667367FEF19F3E4BCA2B2699DB0A601F255582FD22D48F54BDF87E69B8
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

65F4.tmp

Path C:\Users\Admin\AppData\Local\Temp\65F4.tmp
Size 4.2MB
SHA256 aa059ea1e0f6372ecd07156c0b7e5732b563b01925938c7b16682cbc511046df
MD5 179b0f73f040937fc15e696ea29d9aaa
SHA1 fe5287239edad9e324eb6c37b56e8284a6889ad6
SHA512 15f51e16569dabd0ff4840c7c2c9128df948530c65e66cccb0c90842b29c759a2d51523d1454ede4a913d357c05f03c7cf5808da6a454600164007fee9c9a607
SSDEEP 98304:emhd1UryeHrECZ/MSRisydI2JxWVLUjH5oxFbxCVLUjH5oxFbx:elrECJMuiBdRqVUjZEdCVUjZEd
TLSH
T160262391B7D4C271D1C235F9608343DADA783F2D5675C54F2FC92A2EEC688E27678282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2772-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4600-0-0x0000000000400000-0x0000000000849000-memory.dmp