515aabe928ba8ac39e239020592f06a897c0c7da5e0c8e298472e52fca9f320d

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_cf17f8a502e1f107e5820bff985ea088_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-hp35xaed86
SHA256 515aabe928ba8ac39e239020592f06a897c0c7da5e0c8e298472e52fca9f320d
MD5 cf17f8a502e1f107e5820bff985ea088
SHA1 ed80b730ff106296c2853a194459c6d8cb16526f
SHA512 c2048f94b9ca38c7104f3b9693757a0132398f6774c03233793c6df546cf2cdee8f2b0a2f88e09bfb86b4dd0a152685196147bc698de99095a6973b891f47dba
SSDEEP 49152:Qoa1taC070d2USzWhRsvOt2kSxVxFClWeVDqo:Qoa1taC05K3svO2kSxvF8T
TLSH
T16B952214F3D2C2F2D0810A71AAA2C3E2A8652E7D57959C877BD80B3F1960FD46E72747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
936	D3B6.tmp

Executes dropped EXE 1 IoCs

pid	Process
936	D3B6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_cf17f8a502e1f107e5820bff985ea088_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D3B6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5340 wrote to memory of 936	5340	2026-07-31_cf17f8a502e1f107e5820bff985ea088_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_cf17f8a502e1f107e5820bff985ea088_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_cf17f8a502e1f107e5820bff985ea088_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Users\Admin\AppData\Local\Temp\D3B6.tmp
  "C:\Users\Admin\AppData\Local\Temp\D3B6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_cf17f8a502e1f107e5820bff985ea088_amadey_elex_smoke-loader.exe E11B242D19AEBEA1D4BD221360A3715285945F603FE1BFB063300CE41246158574AFF39657F7C18B894F7F1D41B1C89C85DAF3BE907F223DDCAFB36EC6CAA823
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3B6.tmp

Path C:\Users\Admin\AppData\Local\Temp\D3B6.tmp
Size 1.9MB
SHA256 51c32a0858fa0861451abf30a3e4e0d512fe2afcaa3b3e4f4884b6181c325462
MD5 071753a7ad7c32fa2e557029b3e151cc
SHA1 6b69cc3f2821290dca4b4628df2fc239a87d5b77
SHA512 febf6d488fdb4ca5efc7d087a1bf2132e73fd9bd0d470be64a04bdb9414e39aa9e0a7ac0bad006464bb33bda0f08f55b22e35868d034268eef313ef7724d039d
SSDEEP 49152:Qoa1taC070dQ3BRMb4jx/cphJhuTM+0621Ns:Qoa1taC0J3BKb4a5uTg9G
TLSH
T157952350F7D1C2F1C8850671A6A1C7E6E8793D7857068D47BFC81B6F29A0FC02A66B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5340-0-0x0000000000400000-0x00000000005E6000-memory.dmp