8b248b35f3e77ba1f302ebf42039709c905b7ead02ed513a5da84cf387f2e162

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_ba672517ee0bf4f32fcf442d0b0d8529_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-vgl8mswgpg
SHA256 8b248b35f3e77ba1f302ebf42039709c905b7ead02ed513a5da84cf387f2e162
MD5 ba672517ee0bf4f32fcf442d0b0d8529
SHA1 f95948e8c163598cb93b9ff574a600245c7c7b93
SHA512 2ab1209e131ba570a056877facab52c77f71d1781b108169f8d0fa8ac447eef54ece3c3a9c63651a162436970c77a1e15cd184c5d4ba6492b03af84fc9cee30b
SSDEEP 49152:Qoa1taC070dD2BZZPBDaUbjr8sVGxaAVCgbQhW:Qoa1taC0j5PQIHMogbP
TLSH
T13F952210F795C2F6D0810671B5A2C7E7D8A93EBC66819D83BBDC1B6F2840BC06676B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1152	CC44.tmp

Executes dropped EXE 1 IoCs

pid	Process
1152	CC44.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_ba672517ee0bf4f32fcf442d0b0d8529_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CC44.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 1152	4148	2026-07-31_ba672517ee0bf4f32fcf442d0b0d8529_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_ba672517ee0bf4f32fcf442d0b0d8529_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_ba672517ee0bf4f32fcf442d0b0d8529_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\CC44.tmp
  "C:\Users\Admin\AppData\Local\Temp\CC44.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_ba672517ee0bf4f32fcf442d0b0d8529_amadey_elex_smoke-loader.exe B58425C8504CE64F6BB934DCC4C26FEE270EABDFFEB08E41976DB8AEE48C38217623E7CD9D710802FB2DC51BDFD5FDEB2E481BF91C4CE7F7836FDF9E05C7F058
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CC44.tmp

Path C:\Users\Admin\AppData\Local\Temp\CC44.tmp
Size 1.9MB
SHA256 47d955712c6f75f68d9789f586cc20968ce541afebc7c7783b93040d15571e1a
MD5 da54fa7ca5b2a49864da3ac242cf9a72
SHA1 9854d5ddac8bbc8dd6d872b95c8b686f71fde1d4
SHA512 396117b732773e1517995fb4205f01dffad4326ab5dc37c5338070b7dc8b18600548ba25e6d22eabc85a658b1fc636a04f7a717bcf7005e45421da99feeb1bdc
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d+6VlQ3YtGNnfCzzwJ1cyEzMip5YCKP4FS0zs:Qoa1taC070djXoX4A1cyEzlLYCIO7PeH
TLSH
T1DF952314F7D4C2B2C0810AB1A682C7E3EC693EBC5B529D837BC91E6F1D64AD05A71B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x00000000005E6000-memory.dmp