c083d9f3b8142cdac3929d2c0706c4971b0518c42d42ab675c0c5b3f2be9cb07

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_206e7fbbde0fef6beca6f0b02c793581_amadey_elex_smoke-loader.exe
Size 3.3MB
Sample260730-gl5nwscg24
SHA256 c083d9f3b8142cdac3929d2c0706c4971b0518c42d42ab675c0c5b3f2be9cb07
MD5 206e7fbbde0fef6beca6f0b02c793581
SHA1 d23bc08730df8dcb0370dd460ef40422b96587cc
SHA512 bc6ae4904f26fb1d26b4b47022e96f518bc275bd86c324ad6229256121e908cf943bc40a858c974caf3e208deb4b5751aa2a6e41acf072284d4ca2ac2a9f9bbe
SSDEEP 98304:QmSWOiIyUL8ms5vZQMhAutxeRVLUjH5oxFbxG:QXmf5OMuVUjZEdG
TLSH
T141F52202B714B0F3C2117AF4749657C391316DBB7B2599C72EC4238E4CEAAD8AB57B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4660	4E26.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_206e7fbbde0fef6beca6f0b02c793581_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E26.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 4660	1200	2026-07-30_206e7fbbde0fef6beca6f0b02c793581_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-30_206e7fbbde0fef6beca6f0b02c793581_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_206e7fbbde0fef6beca6f0b02c793581_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\4E26.tmp
  "C:\Users\Admin\AppData\Local\Temp\4E26.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_206e7fbbde0fef6beca6f0b02c793581_amadey_elex_smoke-loader.exe 0788CD42C10A8E696EBEA1E74942E2DDD790ABD92A8F9770779508775379DC4CBCC11247A8DBB1E12033DE5E2636127BF15EC9C31F137A1AB3E540C77CF20A1A
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E26.tmp

Path C:\Users\Admin\AppData\Local\Temp\4E26.tmp
Size 3.3MB
SHA256 ee1178372be4f67f6a009ffb9d566bd8cc12780ecf573f258965a3c290d0e710
MD5 49a85e50edb4ae34a5152f685c5ce47b
SHA1 ed50aaeb6f6d942771f4bba55a682e92d2296d11
SHA512 f9828f3a5a9d9076db13300779ca0b30520d69cd132c2bc5fcbf79def0d2f739b29da632136770661361825186e4599a2e1dcd264cf30b9bf9f1b2e92314982d
SSDEEP 98304:QmSWOiIyUdZHNvo9+YV3gy1VLUjH5oxFbxG:QXTZHNvoJJ1VUjZEdG
TLSH
T15CF522017750B4F3C2526BF4648647D792302DB77B2199C76EC4234E8CABBD8AB57B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download