1338154967d81a4e0c09358df01eb452dfd201eab17cf11d94aee63a6e725359

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_83dd48cb1fb1c779b9359dc05f68f897_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260729-a7bvda1blc
SHA256 1338154967d81a4e0c09358df01eb452dfd201eab17cf11d94aee63a6e725359
MD5 83dd48cb1fb1c779b9359dc05f68f897
SHA1 39e2ca8d31c48f56a9d3fa4a66e81cd5e68173bf
SHA512 6a44c55d51ec47674b31bfcf6c1a31a6be829e5f660c8025b43dc07d332fd3af182f85ac2a8005acc110c5fc0f76c8de246cd0a803aef40bdd18198c69c7eb1a
SSDEEP 49152:eoa1taC070UfRx3u8YIRvKN6I+cZPya4BiywhOcq9yquEB:eoa1taC0HxuNIRv/2PydBiyNxl
TLSH
T1BD952362FB80C3B6D0814B30A162C7E29C697E3D56519C83BFD91A7F2C94ED06A7171B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5116	EF8B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5116	EF8B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_83dd48cb1fb1c779b9359dc05f68f897_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EF8B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5116	4264	2026-07-28_83dd48cb1fb1c779b9359dc05f68f897_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_83dd48cb1fb1c779b9359dc05f68f897_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_83dd48cb1fb1c779b9359dc05f68f897_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\EF8B.tmp
  "C:\Users\Admin\AppData\Local\Temp\EF8B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_83dd48cb1fb1c779b9359dc05f68f897_amadey_elex_smoke-loader.exe 5C15E059D43D94CCB0E223298267042128DFA8C1D8679D5604709A46C33C6C6702283CA63BCB4A6C86102EBEAADABD193C9BB922443D68D3A7953A52D983A45A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EF8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\EF8B.tmp
Size 1.9MB
SHA256 741a8d7480f9fb5d6b4cf0af7cdaba8fb3c6307613a50353b38b619525bd8a26
MD5 3b1c371fca54cf45b5fc96ee4c493558
SHA1 f84e93e8cf041e7be4bee1e48a0488412ea61097
SHA512 e11db1adfea06f79155269bac786a63a9975ba83d29df0ffd0fe80c63a9d01ad6e0935539fade483fb3327eaee0b22ab25d76a2de40aa178a1a59c1056303916
SSDEEP 49152:eoa1taC070UEcyNZWhkfTq5lnV1iKUQxb:eoa1taC0mckZWhkfejqK
TLSH
T145952321F394C1B6D0810671B591C7AADC363D7887058DC3BBCE2A7F2A64EC06AB2757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5116-6-0x0000000000400000-0x00000000005EB000-memory.dmp