9422c66592ced5df6ad7c2e6fc25725f3b31a8bdd92788c23fea506b272b5c0c

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_95f8b47b4eb324549738c56a870f6159_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260730-fwrdkscb89
SHA256 9422c66592ced5df6ad7c2e6fc25725f3b31a8bdd92788c23fea506b272b5c0c
MD5 95f8b47b4eb324549738c56a870f6159
SHA1 25a796b11c0beee09347f18941ae7389977c2a70
SHA512 0bd4d36f653975ef7085eb1af01497453bc3aa4a21ee3facd9f558c978804ec193eefdb0a3b2dd194919738f7350aabd99d5b48995f8da120bfc2630edd32841
SSDEEP 49152:yoa1taC070Uq8H+rT8MzHRBofntRce6fw/YcdvOJFIg:yoa1taC0jH+nx7jMce6QYZ
TLSH
T1EAB50205B704B0F3C6255BB0A955DBA2A2216CBB7B019DC769C4635F0CDBAC8AF13F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2804	93F9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2804	93F9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_95f8b47b4eb324549738c56a870f6159_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93F9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 2804	5812	2026-07-30_95f8b47b4eb324549738c56a870f6159_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_95f8b47b4eb324549738c56a870f6159_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_95f8b47b4eb324549738c56a870f6159_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Users\Admin\AppData\Local\Temp\93F9.tmp
  "C:\Users\Admin\AppData\Local\Temp\93F9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_95f8b47b4eb324549738c56a870f6159_amadey_elex_smoke-loader.exe E4C31C9DD50CF87C0C7830A254298CAC06C8F3204C106B9A099060817CC6715D42219DB22A91021D6F685FEE9652EA4F3E84A9A70B6F5C27D1C0A823FB455ED8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

93F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\93F9.tmp
Size 2.2MB
SHA256 1ffb07d788b5747ddb63b0a7da3ff1854cb06f253a5430cba535e5da0088d0bc
MD5 ecffce8dbc102c3eb25e10977d633406
SHA1 9faf6fa618b44a499bbcb6ffdf551cab00d26e12
SHA512 00ae289f72cf4dd10903a2bd3355929259b559f4c63ebc0e20983b0a1eaf9f78c7800e4840f8ff85976776604ffcdf0e80db5e19dacfa15603e22d4e82b84aa1
SSDEEP 49152:yoa1taC070UKCDJPP1Kqq16aiJ/YcP3gd1qWWFORcdvOJFIg:yoa1taC0gKJk71q/YPsFORZ
TLSH
T1EBB50205B614B0F3C6215BB0A9A5D7E3A2216CBB7B419DC769C4134F0C9A7C8AF53F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download