7c25fda71366b0376aa98b158e700116dd22470eac36c2449cb1a9193d2e55e1

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_2b13ad36217e7f9a5bdbfc3ad96620e1_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260730-2k1zjaydrc
SHA256 7c25fda71366b0376aa98b158e700116dd22470eac36c2449cb1a9193d2e55e1
MD5 2b13ad36217e7f9a5bdbfc3ad96620e1
SHA1 54268e560ab5e76520e0bfa337d13b62a04360c5
SHA512 d6f1dd7a0a9fda5ff3c3ba86e41c76665b5d3e108c6c2677bf6e8154bb1a81e894d4b159ded7b05ef6ae9eaa07d256a4ee1368302119e752d6f2f85b146bddbf
SSDEEP 49152:Qoa1tLC070rsSqOJlg882RKGi29ThTS8US8G0T5Gi9:Qoa1tLC0d2k87rrTsS185
TLSH
T131952315F399C5B2C0C60676A192C2E6DC2D3E7C53419E83BFC95B7F2960EC16A21B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1792	8999.tmp

Executes dropped EXE 1 IoCs

pid	Process
1792	8999.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_2b13ad36217e7f9a5bdbfc3ad96620e1_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8999.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1792	1512	2026-07-30_2b13ad36217e7f9a5bdbfc3ad96620e1_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-30_2b13ad36217e7f9a5bdbfc3ad96620e1_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_2b13ad36217e7f9a5bdbfc3ad96620e1_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\8999.tmp
  "C:\Users\Admin\AppData\Local\Temp\8999.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_2b13ad36217e7f9a5bdbfc3ad96620e1_amadey_elex_smoke-loader.exe 5D5C7D11650AAA119B03EB2B6F2F027D7551E2C0A366AEAB9C7C161948CC68D8C19F2A1BF8244C7BBB1B0AAA8FE9D83066D892FDF75D052C60E06D4FD8F200C6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8999.tmp

Path C:\Users\Admin\AppData\Local\Temp\8999.tmp
Size 1.9MB
SHA256 104f1fb37ead5d1577a33125445054d340dc1682aa36ef11697933f7bc4dff33
MD5 71784e8c29028b18869bd8343b73de13
SHA1 e745afc5d98703a45c09e167e88a35a2ff98c37c
SHA512 7b159b4fc2569ad148935173a3c006ea44c9087b36ffac833267f41486044ac8129555a879ecbe731b96160c2177b5a38d59b125f3e7a07da59b36bd50c866aa
SSDEEP 49152:Qoa1tLC070rmAnI2Pxa+GaJhBfceWsV411h77HcQGX:Qoa1tLC0vAvQ+/j0eghHc
TLSH
T18E952255F781C5B6C0820976E991C3E6D9293D7C53869DC32FCC1E3F29A4EC06AA6B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/1792-6-0x0000000000400000-0x00000000005E6000-memory.dmp