a8188152b639b3be182420f01d57babde99ae5d18c2ae969fe1fa0f322fe19f5

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260729-gexppsxydx
SHA256 a8188152b639b3be182420f01d57babde99ae5d18c2ae969fe1fa0f322fe19f5
MD5 4e312ad3974babc33a0e7d5adfe17551
SHA1 0a2ac2eb28edfd0e47522d5b2d32ba002c0316a8
SHA512 c11ac6b7a944ae306d372ded9caa37d5c33bfec72f960118c2c01135ef383935ebaa8f45fb54f91e9f041ac5b4ad144bf2858e602a49836f759b8e959d6eec11
SSDEEP 49152:yoa1taC070ULiHsiKyP/ibRx+lq4i1RncPXWBicdvOJFIg:yoa1taC00bl6+lqf1uPXW8Z
TLSH
T15AB50206B714B0F3CA515BB0A956DB93A2217C7B7B009DC72DC4535F0CAA6C8AF52F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3732	2B5.tmp

Executes dropped EXE 1 IoCs

pid	Process
3732	2B5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2B5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3732	4736	2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\2B5.tmp
  "C:\Users\Admin\AppData\Local\Temp\2B5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe CBC23AABD76E977D4B0D528EE1E29C95E1695C935EB6C16CEFB3DCD2CCD911F577689C631F0E87E35CCCD305ADFCF37377E2159BBD37EC91270AEA5F82AB4D6B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\2B5.tmp
Size 2.2MB
SHA256 e396ce098cdf74d4afbdde37a7fd8ee1f6db8d93616c48fd5ea861188380b8e7
MD5 90d63b0763c6fbc6ba602671ae5375d0
SHA1 06da3530e2299aa65b90253e4cc9bc29cab3f02a
SHA512 4dc3dc295c1a2b2daaf2ac68856e371521a29ad315fd199dda25660e5df8d01b643e1ecb5b7956c34518342dbfbbd193aec07e7517051bc2ff2ba2d576ad7108
SSDEEP 49152:yoa1taC070Uwn/fHKVGpww2umGSLHCwzcdvOJFIg:yoa1taC0mHkG6w2FG2C4Z
TLSH
T153B50105B754B0F3C5215BB0A855DA93A6217CBB7B40ADC72DC4535E0CDAAC8AF23F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download