de06b7c1b65038fcb330eccfe09ed59aaf595a76a252128e0d9c702417ec2c0c

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260729-mg91psej7v
SHA256 de06b7c1b65038fcb330eccfe09ed59aaf595a76a252128e0d9c702417ec2c0c
MD5 e245ab16c0a56bc0f89dc635a797f408
SHA1 25976984fbd510d7bb86d34703f9607735f758a0
SHA512 537355629de07b2cd247941c6960876b4fed11cf4dbd5abb04b67c4f2c1e9e77c92f44d659af224ffbdc42acd7b3c708d674dffb06e7939ff2af2dbd8195bd35
SSDEEP 49152:+oa1taC070UzxVVuPnnAbhwnOhMyY6woYnj:+oa1taC01xVwAlhJYvoYnj
TLSH
T1B3952310F395C276D0C206B2A2A1C7A3E8653D7857054D87BBD90B7F19B0FC4AA72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4884	4201.tmp

Executes dropped EXE 1 IoCs

pid	Process
4884	4201.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4201.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 4884	2560	2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\4201.tmp
  "C:\Users\Admin\AppData\Local\Temp\4201.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe 54945A52A058F4390B47F591A31616F28AD6060494BB618E8B0FDCCD43B875ED5613ED01CB071F8753D888D8FFC04A5F411A117852D2E18E2F68E2B457549F82
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4201.tmp

Path C:\Users\Admin\AppData\Local\Temp\4201.tmp
Size 1.9MB
SHA256 2da451461ac4ca07b3d777321abdbe20e7bc2091ace1f532db667f8cf409301a
MD5 875030495a157d8898739955dc5b491f
SHA1 0660459a61946c6cd8991e05af5f48df5d6702ef
SHA512 2a924a353aec228c372f2f75de99abe930ce783ab6b926846f9b2621c8c237ef9335e942f7b0cc450ea358ab1819f160dd955b036a4dc899b49d7e393eb883cb
SSDEEP 49152:+oa1taC070UdLyaCBoWNDACoyVy1SWno6:+oa1taC0ytN/o4KSo
TLSH
T110952260F791C2B3D0811AB0A556C7EAE8393EBC57418D87BBC91F3F2960EC45A31697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2560-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4884-6-0x0000000000400000-0x00000000005EB000-memory.dmp