7504f1e0b53a6e37ffed0a68e2ea8cf0488e24fc4e98396e104507a3eb526117

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 21:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_24bc13a855ca30241a5b8b23cfe72278_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260731-1ra61ssapb
SHA256 7504f1e0b53a6e37ffed0a68e2ea8cf0488e24fc4e98396e104507a3eb526117
MD5 24bc13a855ca30241a5b8b23cfe72278
SHA1 aa4d03cebad4fb8870d45f7953e238bad678f14a
SHA512 ef2b403b722e116d3b943cf3cf0516e9cef5731470edca6e5105b6a03f1ba0619eabd9819993d68c5f302d838c84627d8727d0c007cec52842cf4b59b015723d
SSDEEP 24576:v2oo60HPdt+1CRiY2eOBvcj3u10U8NDoXJTXolt1nze1jdQq+C1XkzUex6K2p84j:+oa1taC070U8yG61OqVXPex6/v+Rxo8O
TLSH
T10366BC00916AF3518A812970987EB159D4E5ACA497FC48F33E8C3AF9D773BE37532612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4964	5CCC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4964	5CCC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_24bc13a855ca30241a5b8b23cfe72278_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5CCC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4964	2464	2026-07-31_24bc13a855ca30241a5b8b23cfe72278_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_24bc13a855ca30241a5b8b23cfe72278_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_24bc13a855ca30241a5b8b23cfe72278_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Users\Admin\AppData\Local\Temp\5CCC.tmp
  "C:\Users\Admin\AppData\Local\Temp\5CCC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_24bc13a855ca30241a5b8b23cfe72278_amadey_elex_smoke-loader.exe EEE5A8158D8C92ED6578B8E08892900D81B1A02329EA03474A69D435CFE01293781BD9DBFBECC9AF240C620F785B6386D172B903CE26EB17D0C168F8C5DC79FC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5CCC.tmp

Path C:\Users\Admin\AppData\Local\Temp\5CCC.tmp
Size 6.5MB
SHA256 bad8fbacf7097954f1eb5c6cb318568e3942c98a19d50a2bbe6c79c13837b3e6
MD5 50616339eb01427ce1c24f64adcbd6ce
SHA1 edd98c47d0b566fb17687f8c69c43bb06dd67f8c
SHA512 fea3c4b086ad8b2fbe480c5665a87832615be79ce7f723f771cf9903c1828770735fa7065a1e3454b81e9dede3c71f57d818ec1b5ea229df496e94fee23995b4
SSDEEP 24576:v2oo60HPdt+1CRiY2eOBvcj3u10UqecK1GswGPhKZz24+tJBwMYApMm+zfpD9AA9:+oa1taC070UqeTMsPP+0miLGfFrH
TLSH
T12666CD51956AF3618A812970987EB159C4E4ACA487FC48F33E8C3AF9D773BE37532601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2464-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4964-6-0x0000000000400000-0x00000000005EB000-memory.dmp