558db838aed036623610826a0e67607b8cb01cb81581399a9343e746af83d061

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_f8583b7155640c7c9830e3d95ada30a7_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260730-m4r4eazva1
SHA256 558db838aed036623610826a0e67607b8cb01cb81581399a9343e746af83d061
MD5 f8583b7155640c7c9830e3d95ada30a7
SHA1 9f863ab5d18fe8916d4de222b7ff7534be63f39f
SHA512 2afcce0e7fa3a0f39112f8a70fbebc21923f8a88f5f8e4102bc8e0cb7670ffac472335503c5225594abe1c69456e6a1aedaa1b1e36acecfc01fc9f274767ee58
SSDEEP 49152:Qoa1taC070d/+jCTtQ/OA0XKvhoKpjU7v:Qoa1taC0K+jCpQ/OA0XCJ9U7v
TLSH
T128952210F7A9C1F2D4911631B622C3D298A93EBC47529D83BBCD0B7F6950ED02A7574B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3028	2A23.tmp

Executes dropped EXE 1 IoCs

pid	Process
3028	2A23.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_f8583b7155640c7c9830e3d95ada30a7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2A23.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 3028	3548	2026-07-30_f8583b7155640c7c9830e3d95ada30a7_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_f8583b7155640c7c9830e3d95ada30a7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f8583b7155640c7c9830e3d95ada30a7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\2A23.tmp
  "C:\Users\Admin\AppData\Local\Temp\2A23.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_f8583b7155640c7c9830e3d95ada30a7_amadey_elex_smoke-loader.exe F9A6EEA402D97F808C7BA755782FAF018C3B74716FEB837C700B37C4BD0D192F507A4E23CD86942EFCF544669804BA8633142831261EA3717E227B0AAD308B64
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2A23.tmp

Path C:\Users\Admin\AppData\Local\Temp\2A23.tmp
Size 1.9MB
SHA256 758c840d9c5177b6cef30a289f5cce9fc2b7fce19aa14a60d54f49d895c7c455
MD5 c0b5fad43ca3264e403e2eede773ae55
SHA1 da2299468a161c6525a142e1db735ab1d275f7f6
SHA512 d89c45936e678d8a2ec6b625eb34244efaa8729b0812bb00142c144125013a7e3fbaafd372e9b5b60570f7e9720b5cfc48ddce253f6f6d6ead649d0ea8a3d7c5
SSDEEP 49152:Qoa1taC070d9e5eRPhg0dLJtot4Nb77P10RHXfXtd3U0N:Qoa1taC0Eeapg0doONrSRHVrN
TLSH
T1B1952356F681C2F2D0410A71E6A2C7E2AC793E7D57518C837BC90B3F2D90EC06A66B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3028-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3548-0-0x0000000000400000-0x00000000005E6000-memory.dmp