d39d7f18d4fcbb0eae374093e1eb16416f7c31ea641e69f030155ed2e3137099

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260729-ylqcmseq91
SHA256 d39d7f18d4fcbb0eae374093e1eb16416f7c31ea641e69f030155ed2e3137099
MD5 a7663bf0dc195f159a54c3f1c662b87e
SHA1 f213614683bac668094b326cd58b894a35d68cbc
SHA512 af465e3ecf36a3f4f3a60fb877edef37ecfac36926b6cb14fa10c8f9c965a6ceeac7e35d5a0ab3523d4ba29dd9327e1be52bd0ab626324a11772b50e0d5c38f5
SSDEEP 98304:Cmhd1UryeyLwVizHonD4POm7/e5VLUjH5oxFbxhVLUjH5oxFbx:ClqwEzonUPOmKVUjZEdhVUjZEd
TLSH
T1E1262381FBD5C272E09311FA648343D6D8343F6D51A599473FCE2A2EAC989E5B378243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3684	FD5.tmp

Executes dropped EXE 1 IoCs

pid	Process
3684	FD5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FD5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 3684	5384	2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Users\Admin\AppData\Local\Temp\FD5.tmp
  "C:\Users\Admin\AppData\Local\Temp\FD5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe 797D4205F7CD643549A5D571A2E72B66B3699915EFD33D509CF31B442D52D30FB10F2D9CBF2EBB1E7802E872189602A0A0120D82EE5338E683B64732853FAEF1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FD5.tmp

Path C:\Users\Admin\AppData\Local\Temp\FD5.tmp
Size 4.2MB
SHA256 99df83c8bd6fdb5bcec3509f34c3077042f1f72721ae8cb3557e0e35b837e08f
MD5 df479bae95ceb61bc84f2610c12caec7
SHA1 b83bf5a5b1eb0aa2e80043211ef90640c0fa9cdd
SHA512 d1ce16043a94b0285c0f7e26feb8fc660e45836dd5b292854e417e9b68836b1a44d90f825daad8ed7784c2a7572ebf2438b2032665306d7131fd1aeadd417245
SSDEEP 98304:Cmhd1Uryeiw2jKDN4GFrGvfBXlWJVLUjH5oxFbxhVLUjH5oxFbx:Clq0N4G5GBXlWJVUjZEdhVUjZEd
TLSH
T17C263351B7D5C271D18359F974C703D7E8383F7D42A5AA476FC91A2EACA89E072A8303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3684-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5384-0-0x0000000000400000-0x0000000000849000-memory.dmp