ffcf55cf6b464559d43084b7f821352e2bccfc0b8e5816400861eaa98f6ea94f

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_10f24b4ebde6ee10c84b0d1217046dc5_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260731-lrvs4azzgy
SHA256 ffcf55cf6b464559d43084b7f821352e2bccfc0b8e5816400861eaa98f6ea94f
MD5 10f24b4ebde6ee10c84b0d1217046dc5
SHA1 2b15dd75aa498329088d46a82c3d0d15ebed899a
SHA512 4e7a2130ad4a6fe0ef7cb8e97de4772fb653d16e60085dcd709e105af6fdb6e5f436c10c78a620ae16f6486648a1a0719841cd066e61998d8c7e6bf524eede94
SSDEEP 98304:emhd1UryeRpqau8pLdkjLT3qV7wQqZUha5jtV:elHqaDpL4LT62QbaZtV
TLSH
T18626C00896FCD92DD82F52F4A1641185C7F0A564E7D3AF9A7DA2F1F079823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5160	73CF.tmp

Executes dropped EXE 1 IoCs

pid	Process
5160	73CF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_10f24b4ebde6ee10c84b0d1217046dc5_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73CF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 5160	3004	2026-07-31_10f24b4ebde6ee10c84b0d1217046dc5_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_10f24b4ebde6ee10c84b0d1217046dc5_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_10f24b4ebde6ee10c84b0d1217046dc5_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\73CF.tmp
  "C:\Users\Admin\AppData\Local\Temp\73CF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_10f24b4ebde6ee10c84b0d1217046dc5_amadey_elex_smoke-loader.exe 79B18F7E016277736657E0C29E21231FA92FCA60CC90ECFA7A7D263A2D4BD9C647FCCA720BA43CB77166711035F9DFD5F4CD7F867CB3E73293B4CEFB4E425E18
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

73CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\73CF.tmp
Size 4.3MB
SHA256 3f64f454bdfd5faaa99931a73618565ded36c567815ba1a06443e26a3feb2ea7
MD5 a51a0ac96e3a95a9dbdd5c2b57d39dd7
SHA1 2481828bfda0873be9031f3a356a1e20474ed133
SHA512 47e636116a32a73e75718b2d111ae7b804791546c4cc53ddfca3df3811a121194daed659bb2c08908155ae9a3de00b28977392f9d3551cc4528a46d0b2575897
SSDEEP 98304:emhd1Urye0eOWLgA1pOfGN8wKZlV7wQqZUha5jtV:elTO61pfuTb2QbaZtV
TLSH
T13F26C00896FCD92DD82F52F4A1641185C7F0A564EBD3AF997DA2F1F029823B4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3004-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5160-6-0x0000000000400000-0x0000000000849000-memory.dmp