3830ebaffb40906aa3532a251fe35c273eb1ea2225072e530f99c2baa1068e04

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-gdccdavemd
SHA256 3830ebaffb40906aa3532a251fe35c273eb1ea2225072e530f99c2baa1068e04
MD5 860ed36914a14af7843daba56a60edfd
SHA1 5975196c1698930063d5b8d7287eada88f283c29
SHA512 295f0d3abe68368804904617a50632dda1fdc92b90f67f54214c4a63536ba826b802f690806212166b3b60fbe483a93e43a6190bafbd8590243c254ac0dea5fb
SSDEEP 49152:boa1taC070UZmvwzmH7GKu/f7yVhjx2fDy3856:boa1taC0yISH7GK98fO388
TLSH
T152952315FBC9C1F2C84205B1A552C3F2E8783D7896418E83BBDD1A6F39A0EC46675B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5728	ED64.tmp

Executes dropped EXE 1 IoCs

pid	Process
5728	ED64.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ED64.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 5728	5980	2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Temp\ED64.tmp
  "C:\Users\Admin\AppData\Local\Temp\ED64.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe EE1D8628707ED33EA78DB558AF26D5EAEED89D7A99458C322C7025D19C36E6734A46F6DF0B10365A30D42D5632583EF54B4AC24C6B2589BBA878406C9331EA96
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ED64.tmp

Path C:\Users\Admin\AppData\Local\Temp\ED64.tmp
Size 1.9MB
SHA256 ee0341205ec3f63f5e9ed0001b595ef9ef59b0e4ab93d623111dba17ccecede5
MD5 0c88d02c36ddb5f4fdae463aa03bdb04
SHA1 551d7255412b2eff270186b0673a3e53921a893f
SHA512 badef28771ff98f83aa346863ffc88ea7962ca6f5a619bccec28042f1d363e41f76590a56e07a836a5489e18d5b3c5eecaa422e4beb1b695fec6cc495173aa47
SSDEEP 49152:boa1taC070UWASZG2gZu3hBJDDOSlrhN8SExmpC:boa1taC0k31DDNr3LN
TLSH
T175952341FB90C2B2D0850A75BA91C7E7AC743E7D56859D933BDD1B2F1C60EC0AA22B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5728-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5980-0-0x0000000000400000-0x00000000005EB000-memory.dmp