e0f071c5d79e5b30449ff21865219d2f30dba940263210a5e72c8fc60f15fe34

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_3f7965bd44412109c9d04a02ceafbef0_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260730-jsas7steja
SHA256 e0f071c5d79e5b30449ff21865219d2f30dba940263210a5e72c8fc60f15fe34
MD5 3f7965bd44412109c9d04a02ceafbef0
SHA1 05765835c4e1f1e3cae17dda27050181c91bade0
SHA512 55a0eb5fab1b0628bf327f98ce1e87883e0938745c1e064771c623c4438a9a0308326a2b992a782241304023174073f94cea2dc411068999c0fd501fb0416579
SSDEEP 98304:Cmhd1UryeUIGLgI9jwhfjVLUjH5oxFbxhVLUjH5oxFbx:Cl0fLFwh7VUjZEdhVUjZEd
TLSH
T171263390FBD0C261D08355FD74C343DAD9343E7D52669A876FCA2B2EACA95E073A4243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4184	8747.tmp

Executes dropped EXE 1 IoCs

pid	Process
4184	8747.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_3f7965bd44412109c9d04a02ceafbef0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8747.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4184	4376	2026-07-30_3f7965bd44412109c9d04a02ceafbef0_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-30_3f7965bd44412109c9d04a02ceafbef0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3f7965bd44412109c9d04a02ceafbef0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\8747.tmp
  "C:\Users\Admin\AppData\Local\Temp\8747.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_3f7965bd44412109c9d04a02ceafbef0_amadey_elex_smoke-loader.exe 7747F71A59B2F1806A35E8B516A3B4AC42C38BB857F7FC7C734DA2A6B4FCA7DCA2BEFBAD0F641F675B15FDB3B8FDDAEFBC02E6369F9E0ECD2C34BCB216933E15
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8747.tmp

Path C:\Users\Admin\AppData\Local\Temp\8747.tmp
Size 4.2MB
SHA256 040b5ef335542926fca1b378dd537a0bf4cf5b8c42ba64ff4acb9ff5b374070a
MD5 40449efb1b7011f2ffec331056ae0bca
SHA1 42669cc02b3e33d4a5f6691446a1a691b8c39c2f
SHA512 c638f85af6ccd4eaa2cb0babcbd13231edd5d01bfed86ed798433088c2bd45b61a30c47ada3fdd83ce3cb11799a1ed98e347d8b3e9dfbcd2858483978a6c5f34
SSDEEP 98304:Cmhd1UryeHteD0mXvmVXwfpCVLUjH5oxFbxhVLUjH5oxFbx:Clte4kYwfYVUjZEdhVUjZEd
TLSH
T159263390F7D0C272D18225FA608383E7D8783F7D52959D476FCA1B2FACA89E07668153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4184-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4376-0-0x0000000000400000-0x0000000000849000-memory.dmp