db9d3de00d36d9208b11f4908ab810b1cc037e31456bfb8ffacb7877635603e9

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_9071dea2d7924bd8921702eec93c9a99_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260729-vzydmacb43
SHA256 db9d3de00d36d9208b11f4908ab810b1cc037e31456bfb8ffacb7877635603e9
MD5 9071dea2d7924bd8921702eec93c9a99
SHA1 9bdcd1fe6ee12e44411b241696ec1941b02b2734
SHA512 4a2b9c143d1c61d18564e2ca345dedf8ea2bf3ee5ae0fb1690ae8f2e096fbc7eb622808d5b71472cafc684c345e13609e1ade13cff55e41929eb3f1bf72d9818
SSDEEP 98304:emhd1UryeCAyRQ5oU73FlWLV7wQqZUha5jtV:eliAaKoU71EL2QbaZtV
TLSH
T19D26CF0896FCD92DDC2F52F4A1641185C7F0A564EBD3AF997DA2F1F029823A4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4544	332.tmp

Executes dropped EXE 1 IoCs

pid	Process
4544	332.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_9071dea2d7924bd8921702eec93c9a99_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	332.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 4544	3544	2026-07-29_9071dea2d7924bd8921702eec93c9a99_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-29_9071dea2d7924bd8921702eec93c9a99_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_9071dea2d7924bd8921702eec93c9a99_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Users\Admin\AppData\Local\Temp\332.tmp
  "C:\Users\Admin\AppData\Local\Temp\332.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_9071dea2d7924bd8921702eec93c9a99_amadey_elex_smoke-loader.exe 3FD507E63590FF8F873E9DF05216367F4963C94C2B7D18380241F614CACC1ED8B7571EBE50784F9EEA14695619BAD5293ADC2EBEA5B9A43FE1B35539E2B574BC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

332.tmp

Path C:\Users\Admin\AppData\Local\Temp\332.tmp
Size 4.3MB
SHA256 2a29aef7842d34249ac7d7faf5c45f14716c8cda64ede63b3e54ae2f50f94405
MD5 77f205db9a26ff053d7269bab0718d1a
SHA1 d527f3417ae91afaf851abb61fe7758e2e547aee
SHA512 1f06f9ddac798680a9baab781aed160ddfbb3fcaed6119934e414a274079561bdc8dfd0ed497c97f6b821a945306069168beb13ef84791f756aad633f5183fe4
SSDEEP 98304:emhd1UryeVXG1DioWIi7rKCV7wQqZUha5jtV:elGiFrKC2QbaZtV
TLSH
T10726CF0896FCD92DDC2F52F4A1641185C7F0A564E7D3AF997DA2F1F02A823A4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3544-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4544-6-0x0000000000400000-0x0000000000849000-memory.dmp