Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 14:16
General
- Target 2026-07-31_768de5fca96f21b83fb6ff0bd386bd16_amadey_elex_smoke-loader.exe
- Size 3.1MB
- Sample260731-rlms7ahn9s
- SHA256 0db9e021b9ba278894103b05b933a3f7347635ca98d4c075ee5aaa48e772a93b
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_768de5fca96f21b83fb6ff0bd386bd16_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_768de5fca96f21b83fb6ff0bd386bd16_amadey_elex_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3908.tmp"C:\Users\Admin\AppData\Local\Temp\3908.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_768de5fca96f21b83fb6ff0bd386bd16_amadey_elex_smoke-loader.exe 27EC125CE1835739E0B56995611A37CD0D11869A44727CC63A36A0B432FFB83A739A66EF5C14DC110538051AC4055E7644989F8E9F445FADDF9AC1F0B1E9BAE72⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_768de5fca96f21b83fb6ff0bd386bd16_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_768de5fca96f21b83fb6ff0bd386bd16_amadey_elex_smoke-loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
yellow_button_100.png
2026-07-31_768de5fca96f21b83fb6ff0bd386bd16_amadey_elex_smoke-loader.exe
3908.tmp
memory/704-0-0x0000000000400000-0x000000000071F000-memory.dmp
memory/1148-16-0x0000000000E00000-0x0000000001225000-memory.dmp
memory/1148-17-0x00000000030E0000-0x00000000030E3000-memory.dmp
memory/1148-72-0x00000000030E0000-0x00000000030E3000-memory.dmp
memory/1148-71-0x0000000000E00000-0x0000000001225000-memory.dmp
memory/1908-6-0x0000000000400000-0x000000000071F000-memory.dmp