5978305253789b4f8c7498b09ba37d25bd2622d6a8ded8f94554cbaa3a534380

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a938f7212912c94eebc6e98b6149f517_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-vqdb4ayte1
SHA256 5978305253789b4f8c7498b09ba37d25bd2622d6a8ded8f94554cbaa3a534380
MD5 a938f7212912c94eebc6e98b6149f517
SHA1 a3890ae5a96cb8c5c5c9e5f6803bce78d32d3b84
SHA512 8d169dceec0dd6c2c29109528012ccfd69026d22bf0149e8b6de76de3714f910a7024d96d99310fcafd1556f3b12784031aeb17022b7999166db1a2d3c155ff5
SSDEEP 49152:Qoa1taC070dRiT0NR2hR1rJwrjNwAhVL6h1S2Hd8zD9m:Qoa1taC0i21mtPLqwVJ
TLSH
T103952310F399C2B2D4D20671A691C3E6DCA83E7C42429D837FC82B7F25A0BD4957AB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3668	5F5C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3668	5F5C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a938f7212912c94eebc6e98b6149f517_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F5C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 3668	5792	2026-07-31_a938f7212912c94eebc6e98b6149f517_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a938f7212912c94eebc6e98b6149f517_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a938f7212912c94eebc6e98b6149f517_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Users\Admin\AppData\Local\Temp\5F5C.tmp
  "C:\Users\Admin\AppData\Local\Temp\5F5C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_a938f7212912c94eebc6e98b6149f517_amadey_elex_smoke-loader.exe 1C23B4FC3594EB7B95C54579BC725C991052AE3299C828B7522330D7C9C0C06B59DD67BAD9091AC3093355FE5BEDF08C20E6428A5272184EA26779777E320C69
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F5C.tmp

Path C:\Users\Admin\AppData\Local\Temp\5F5C.tmp
Size 1.9MB
SHA256 cd5a0be308e1a2fa594fcc72198ac9d75a995e360e745085834985df764c9546
MD5 018dbe3425b689fb8b7fee53b62e8ac1
SHA1 d1035b219ee8614f41041a9fba184a83762512c3
SHA512 2812089e3bd90f279f09c3579ea69d48d8cf1294cb425979af91ad8b039930dc0d909de17011f96cb220410db627a38a843deccc661171314532efec4e9ef26f
SSDEEP 49152:Qoa1taC070dXhU36juLxCg0RzV+Tj0eA:Qoa1taC0dDxdIOf
TLSH
T175952211F794C2F2C4910A31A942C7E6DC693EBC57519E837FC81B7F29A0EC06A26B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3668-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5792-0-0x0000000000400000-0x00000000005E6000-memory.dmp