7ade33f1c71335f9953cbbd4599c841ea91acc10b1239b723402f20eee6db255

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_0d587ca7920557fcb7fb751c3de14290_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260731-1xbdzahn4x
SHA256 7ade33f1c71335f9953cbbd4599c841ea91acc10b1239b723402f20eee6db255
MD5 0d587ca7920557fcb7fb751c3de14290
SHA1 f6c3029d13d4d67ab48689f6043448cb3f1375be
SHA512 6a7d68d70778f611d1cd9857b714c7b256facb41667973646f8de1d102255a9e4395b9dd59c627fcb70ee3a873728a908f33ff014d28e352e30b0bf9c9ad1a7e
SSDEEP 49152:foa1tqC070Xx6lSSGpgzQaPqHMvi8mSjnpSalz:foa1tqC0J1qsPnp
TLSH
T136A50241A3E68170F4A75A3099B282529D763C785BF099CF2EB8D65F1E71EC05D32B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4992	824.tmp

Executes dropped EXE 1 IoCs

pid	Process
4992	824.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_0d587ca7920557fcb7fb751c3de14290_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	824.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 4992	4660	2026-07-31_0d587ca7920557fcb7fb751c3de14290_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_0d587ca7920557fcb7fb751c3de14290_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_0d587ca7920557fcb7fb751c3de14290_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\824.tmp
  "C:\Users\Admin\AppData\Local\Temp\824.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_0d587ca7920557fcb7fb751c3de14290_amadey_elex_smoke-loader.exe 83F5D182B31EDDEDCD839F2ACDC0A0DFC4104A514213539508FA9C989A2F720387DDABDFBE92431ADE1BEB22BABAA26B15AE879F1E07F1EE9DBF8479A7E2B050
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

824.tmp

Path C:\Users\Admin\AppData\Local\Temp\824.tmp
Size 2.0MB
SHA256 dde4e1f49a5c3a359054528234b9b24a3a80b0869f00b66afcdbd5e95f9453cb
MD5 dfaaf43582d7ff88ea50340129c00b97
SHA1 f9428f03a67b5b47a914a5bbfc9da7b16026af26
SHA512 fa6b91a1b8f76e68403f26f73412ce854a38c6a372eb46529a047c587d0ed1ccf8b8a744e5086eb13e62b273554c1c24c5cf7fdbc95afdb77ea4d9e855388d41
SSDEEP 49152:foa1tqC070XjJFVvgIthHzLhwfKt3LHZuu0osPsalz:foa1tqC0yroIffhfisws
TLSH
T19BA50101B3E680B4F0B35A3199B282519D763D782BF1998F2EB8DA5E1D71EC05D72723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4660-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4992-6-0x0000000000400000-0x00000000005E6000-memory.dmp