d71d5c93cd3d85658c011db0968e3d345b1376798872f9a10344dfe91a008649

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260731-xc88qaem41
SHA256 d71d5c93cd3d85658c011db0968e3d345b1376798872f9a10344dfe91a008649
MD5 360ee5dbd0b78a232d578db9d3edf25f
SHA1 40a8c6b8774ff756273dd7258501a16e6639b495
SHA512 b65316080db66f7b749bd1eb6b20e72019c04b2b1c2cf72e40a4422512952a22f71fc3d35d03e4e7a5694543b8a07bc2ce4a17119c17a9c6f68d97f3915c4530
SSDEEP 98304:emhd1Urye0ZQQ2972iLXHNpxFnjV7wQqZUha5jtSn:el39t3xlj2QbaZte
TLSH
T14F26D00996FCDA2CCC1F51F4A1A51145C7F0A564EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3216	1822.tmp

Executes dropped EXE 1 IoCs

pid	Process
3216	1822.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1822.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3216	1312	2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\1822.tmp
  "C:\Users\Admin\AppData\Local\Temp\1822.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe 9BB2AAE822438EBBBBAB7D2117858D304F62CA4DFE6E4A67F0488539A58563890CC53ADDBF42CC2C532D33F622B58AA5F4019F0862C7A22DCA4CAE429037FC4F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1822.tmp

Path C:\Users\Admin\AppData\Local\Temp\1822.tmp
Size 4.4MB
SHA256 f70753502a80f15d0df6c71732648e8cb4fa0179cf4b84b5236683fef40352e6
MD5 f203e4b2fa3d422ffbb5b747569b0cf1
SHA1 4484cd1eb82d03bfb5faf7a066ef7a1b3a5ed604
SHA512 41f3578dd0884b0e530f4d6ab40b449cb812f0ac98d395db1fc9bac32003d93df62d876e287e00deb1945986578f3043575481c8602fe1c59d4499154661e8d5
SSDEEP 98304:emhd1Urye4PbSPPNDcHHcV7wQqZUha5jtSn:elYqdcH82QbaZte
TLSH
T13B26D00996FCDA2CCC1F51F4A1A11145C7F0A564EBD3AF997DA2F1F02A823A4B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3216-6-0x0000000000400000-0x0000000000849000-memory.dmp