c2cd6aa81e982ca1e71fb1585a48f39da6abb099fe1c61d4e843c87314ac7688

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_5a5d5e87f8f299cdb363af41463aa948_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260730-2fd9zagf54
SHA256 c2cd6aa81e982ca1e71fb1585a48f39da6abb099fe1c61d4e843c87314ac7688
MD5 5a5d5e87f8f299cdb363af41463aa948
SHA1 7e33f9c2b209cf1afbd2def456cf2b52336e7815
SHA512 1df21ed1dc8b41f8a9b13f1fcb7f570d1a12ab623bbd9806903887415d0d28d638ad534b3a20ebaab3dcc8db1d8f3578c02f345c82510b4378a6126a715a5373
SSDEEP 98304:emhd1UryeBaB6GTBsHBHTVLUjH5oxFbxCVLUjH5oxFbx:elhaBMVUjZEdCVUjZEd
TLSH
T1E9262340B7D5C361D0C275F9608383DADA383F3C4576998B6FC9262DECA89E63779242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4356	EC3B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_5a5d5e87f8f299cdb363af41463aa948_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC3B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 4356	3452	2026-07-30_5a5d5e87f8f299cdb363af41463aa948_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_5a5d5e87f8f299cdb363af41463aa948_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_5a5d5e87f8f299cdb363af41463aa948_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\EC3B.tmp
  "C:\Users\Admin\AppData\Local\Temp\EC3B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_5a5d5e87f8f299cdb363af41463aa948_amadey_elex_smoke-loader.exe E7F64D200EC9BD027EA0D436E0E5D55875B70093FCD276C828891F66EEA58E54D0B2EC26592EDCC3DCCE012276DDF41B7683F28AD527F0774585EB5361ED4D01
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EC3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\EC3B.tmp
Size 4.3MB
SHA256 48c6b084e2d7b56a7ee7341eba858b5fdcb42a0aee9528c9828f4d23a06000e1
MD5 7749104886b96d82a9b46094e0a54c11
SHA1 8f1b1d01e6cf518c4ada7815892b0207626a43b3
SHA512 1192917937681ba1c27a21b53abf3bad3b0d16c0a48a8b6d7148df5c04212bd488a94d55305e7cdb58ae08140859c506f9ec0c90b7616f722c4c8cce22964f5f
SSDEEP 98304:emhd1UryeyrfrJq5yDRM5MVLUjH5oxFbxCVLUjH5oxFbx:elSrfrEupVUjZEdCVUjZEd
TLSH
T16C262350B7D4C262D0C235F964C743DAD9343F3D55369A4F2FCE2A6EECA89E26178242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3452-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4356-6-0x0000000000400000-0x0000000000849000-memory.dmp