1c0d93f6ee4579ab059e5f5ac226a93440adaafe16b1b531638aeccb6b0ef591

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_723d588b9cc99ce40a519ed703e78070_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260731-whythayzew
SHA256 1c0d93f6ee4579ab059e5f5ac226a93440adaafe16b1b531638aeccb6b0ef591
MD5 723d588b9cc99ce40a519ed703e78070
SHA1 d7624d5e1e1fdbbe79a8031f73a498e48613c089
SHA512 6bd8a3923012749f8f01bda32262ec3600b85e98b9f3c5cfbd624a1f6e28bad08a6b4ec64c197e409f753f2a3f1be5206d45f0358e8c4dfa4f399f03477bdff6
SSDEEP 49152:yvm2AC0d1XqrdryeJVy8CeuGFjWFwvqdZvZwLVT5kUvgJSgHT6ojkxFb:+mhd1UryeW88GPUvCVLUjH5oxFb
TLSH
T11D262380B781C2B2D08035F9718383E78D743E7C5665998B2FCE2A6FAC689F5B675143
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3460	F75B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3460	F75B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_723d588b9cc99ce40a519ed703e78070_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F75B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3460	672	2026-07-31_723d588b9cc99ce40a519ed703e78070_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_723d588b9cc99ce40a519ed703e78070_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_723d588b9cc99ce40a519ed703e78070_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\F75B.tmp
  "C:\Users\Admin\AppData\Local\Temp\F75B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_723d588b9cc99ce40a519ed703e78070_amadey_elex_smoke-loader.exe 56E025B60859F7C6F8EDFF4EABD282113FD23CDB05F1B9E464208BDB6C93DCAC6658CE55BE961BE99789D01A57A9DDD64FF23E5E3C51A76AD3198C0F146B3A94
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F75B.tmp

Path C:\Users\Admin\AppData\Local\Temp\F75B.tmp
Size 4.2MB
SHA256 d70778f2b809e672bde59aaf48f415623fa6ec4f4db2f22a163aee58b8091216
MD5 be74e26628aae8c08e54fbb6554fbbaf
SHA1 1c9869dc5c10f6af74ca483712a95c3c1d6979c3
SHA512 d1c78aecf144186c2f7731e1bcf0a24a14b5a36f50e758d1ec2bf10d123f4821cefe693175eded28ff5d5c2d48d05c1b9d193fdd05fe4a6f840a80224ebad652
SSDEEP 98304:+mhd1UryeMM8KD7AtzYwZiqHmP9VLUjH5oxFb:+lsdKD7A5Y6PHmP9VUjZE
TLSH
T1C3262341F780C262D08474F9648283D799B43E7D9A61AD8B3FCD2A2FEC64AF16675343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/672-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3460-6-0x0000000000400000-0x0000000000849000-memory.dmp