99e7184a279df212f248072edcb4a0375b74aec2f63af1819a5f4ae53508b1b9

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_090f136441283bbfc480e09e18d0e106_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-x2a28afk5x
SHA256 99e7184a279df212f248072edcb4a0375b74aec2f63af1819a5f4ae53508b1b9
MD5 090f136441283bbfc480e09e18d0e106
SHA1 fa43c0cceaf0c79d5a8d9ba8464b5b25c68188ec
SHA512 da3943bfe661f1d369bc37fc5fe38bf42b1ebd742a54cb8c0bef2520a0b9377c6149e89ffbea0e9437230a25bc9a6a297ecfd25f8c269e65d2a67bb02d3d8db6
SSDEEP 49152:Qoa1taC070d+jOYp+li0q+N1zZBEwRnwGGMO9yJrrMISx1MT2O25k/:Qoa1taC0fj54FTnNBE8nwzYU1sRl
TLSH
T165952211F794C172C0920675A692C7E6ACB93D3CA7158DC37BC91E2F1E94EC4AA3A707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3084	1478.tmp

Executes dropped EXE 1 IoCs

pid	Process
3084	1478.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_090f136441283bbfc480e09e18d0e106_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1478.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 3084	5840	2026-07-31_090f136441283bbfc480e09e18d0e106_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_090f136441283bbfc480e09e18d0e106_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_090f136441283bbfc480e09e18d0e106_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Users\Admin\AppData\Local\Temp\1478.tmp
  "C:\Users\Admin\AppData\Local\Temp\1478.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_090f136441283bbfc480e09e18d0e106_amadey_elex_smoke-loader.exe 50B0E1F65764B39097FE90140242981C2C2A6261ECF7E12DD27CE472F65DBF3A902280B0CF6AE32C55680F43323F00C66673FA9B4FCC3057F270CF144472F6FE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1478.tmp

Path C:\Users\Admin\AppData\Local\Temp\1478.tmp
Size 1.9MB
SHA256 b665e91198fb2ac681e90595d08d839fdf87db795314cc36e9c80c77625984c5
MD5 92b182f9a152bf79fcf45e6152a0d3c3
SHA1 652d20ffcf540ae8918e980cc7c1cf7f3d9ca157
SHA512 d62b5d6b773a96e2d74f8560ccb2a91fd273a6037e7e4c782d09b09bb776b5daf73a57fa4637f093c6b69a186b4ae3a44a6b0bb0a7ad1dbf87ce83255cce7272
SSDEEP 49152:Qoa1taC070dfOH9QxjYbTrFmIhwHAXovsy/:Qoa1taC0bQpYbfqHn
TLSH
T1CF952290FB91C2B1D0810675F292C7A6D8A57E7D4A029CC73FC81B7F29A4EC06A35767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3084-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5840-0-0x0000000000400000-0x00000000005E6000-memory.dmp