9ba699feab87a7111cce81722a71c0fc7bf3a5b5192c2f06ea4536bf73d6e955

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_39e68ecfd5c5e7466e1be10c9c525ca8_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-xbhdlszyf1
SHA256 9ba699feab87a7111cce81722a71c0fc7bf3a5b5192c2f06ea4536bf73d6e955
MD5 39e68ecfd5c5e7466e1be10c9c525ca8
SHA1 8df4a6402ce212d18158586128b6bc6a11f162c2
SHA512 7b4ff5110710a4338f2e29f8bb3e6940f975ad4b9c5b76c8dd68e1553f1991205c1571a64fc33a5b427ea6721b2dac3eef0b1339382fe701dffd40d0e82aaa32
SSDEEP 24576:e2oo60HPdt+1CRiY2eOBvcj3u10dxDB5ug/bvWXQ7lQmTpyfXU74F5BJ9PvlhGn4:Poa1taC070dxBb+gBQmTs87Q/l4nZaF
TLSH
T1D4952211F7C4C2B2D0820670A9A1C3A799763EBE96419C877FD81B2F6D60BC09F26757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1012	60D3.tmp

Executes dropped EXE 1 IoCs

pid	Process
1012	60D3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_39e68ecfd5c5e7466e1be10c9c525ca8_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60D3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5204 wrote to memory of 1012	5204	2026-07-31_39e68ecfd5c5e7466e1be10c9c525ca8_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_39e68ecfd5c5e7466e1be10c9c525ca8_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_39e68ecfd5c5e7466e1be10c9c525ca8_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5204
- C:\Users\Admin\AppData\Local\Temp\60D3.tmp
  "C:\Users\Admin\AppData\Local\Temp\60D3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_39e68ecfd5c5e7466e1be10c9c525ca8_amadey_elex_smoke-loader.exe 125739BEDB237B32A7CBBDFC1B65C70BAC5794BE17D3ABB21C1BCFFBFF75DE2F08E84F450110EF254CE0699C24CB2EF94895DA80172596B58D769A1EDD1F383D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

60D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\60D3.tmp
Size 1.9MB
SHA256 2ddaa104c418038911b5e801ae49fa7f51ee44f2cb2beec49d00d8263d8bfa4b
MD5 f9eb12eef23355bf92602edd1026458f
SHA1 974cd79e50c65cfe6b8b2d5ec5da701edea5bf77
SHA512 9fac1fca7157a79ee508caee2e9e74994fc73aba6a58f47d7d05869a6763f781cb31918d0d7f055ed1bde73911e3a7ec7124583fdbae589cdd1736668630956c
SSDEEP 49152:Poa1taC070dU2qk/f4X0AOIcgQ6PbEVOott:Poa1taC0/lO4XlrzoVlt
TLSH
T145952364F7A6C1F2D08606B1A591C3D6E96A3D3996528E437FC81A3F1CA4FC04E31B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1012-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5204-0-0x0000000000400000-0x00000000005E6000-memory.dmp