72d63aa8c6cc44aaf29d01edb59ef6073fd44e8b5ccdbcde5ed66193b87d75f7

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-1mnasahl21
SHA256 72d63aa8c6cc44aaf29d01edb59ef6073fd44e8b5ccdbcde5ed66193b87d75f7
MD5 38be9c50f597e082ecffe33d94060cf6
SHA1 da11ee99787e935963e7af3167797c0e14c7dff2
SHA512 f35a7f91bf17e9b3b1ec7719fd6e8a6d5781129248fa56b218a906aeec4181e8c4a395b8beaee9bba378370b9df8f944ad0f928c2c60dfbbf8e5f9228d04bf83
SSDEEP 49152:Qoa1tLC070rZuACczHbmusF29r5Krl05UWLSfY:Qoa1tLC0f4/Gsvu
TLSH
T19E952280F790C1F1D0861A74F552C3E698B93EBD56018D53ABC91B3F2EA4EC46A78B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1412	C1EF.tmp

Executes dropped EXE 1 IoCs

pid	Process
1412	C1EF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C1EF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 1412	4120	2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\C1EF.tmp
  "C:\Users\Admin\AppData\Local\Temp\C1EF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe AEC5808728EDD5AFDB9E81866B2761CCD871AA38C0342D8A950AC38ACB42E6B00AEB71C9760FDF89D1D54B57CC6EF654482C0257C41E3B93F0B792E54DB2AF8B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C1EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\C1EF.tmp
Size 1.9MB
SHA256 711dc8efc821f8ea190f493cdccb0dae1886b605c29ca40a8c54766efae6137f
MD5 da8ed188a2370ce406314a43d183374b
SHA1 adf9c0205121dff953f4c0bc65068d54e874389d
SHA512 7a85869453875dea951511beedf0947b7486d7e7ae68b07ae1e2f0ccee5004f0debd5d1682159efb444e2f09989dc011ba74a6bc6d91455f09f9cfb75c915b3f
SSDEEP 49152:Qoa1tLC070rMnMqmYAYmJ4pQGTy348xoY:Qoa1tLC0rnMrYA3kQx34w
TLSH
T160952290F790D2B2D0C10634B1A2C3A6ACA43DBC46459D837BDC1B6F2DB4AD16E7A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1412-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4120-0-0x0000000000400000-0x00000000005E6000-memory.dmp