f36bf1617b46546d0e271c8ad295b6af047a9b4db032de98f14ecaa8967856c5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_2f27f0aa2ad6de9f5b3c62e753e585ac_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-xf75tsfa47
SHA256 f36bf1617b46546d0e271c8ad295b6af047a9b4db032de98f14ecaa8967856c5
MD5 2f27f0aa2ad6de9f5b3c62e753e585ac
SHA1 bd8869b172945bc9ee43351433e473e78d44f329
SHA512 1b85a560cd2d88f8147bd3d8d1b40c4476c725606f4050256fc88497fa8a9f9ee4d1ec7a80c80e2e461b43678895ccd7ac5b00791719dcabddd458878d68550f
SSDEEP 49152:loa1taC070dcsCxALQNVPcpJzKFmaAGvb4B:loa1taC0yjCVPcDxIk
TLSH
T1E5952264F391C2B2C0810571E692C3A7EC753EBC5A459C836FD9172F2DA4EC06B66B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
624	55F6.tmp

Executes dropped EXE 1 IoCs

pid	Process
624	55F6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_2f27f0aa2ad6de9f5b3c62e753e585ac_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	55F6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 624	4192	2026-07-31_2f27f0aa2ad6de9f5b3c62e753e585ac_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_2f27f0aa2ad6de9f5b3c62e753e585ac_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2f27f0aa2ad6de9f5b3c62e753e585ac_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\55F6.tmp
  "C:\Users\Admin\AppData\Local\Temp\55F6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_2f27f0aa2ad6de9f5b3c62e753e585ac_amadey_elex_smoke-loader.exe 2F74BC9715A1C737D2ACEC7FD717480EEF2D79F0BAB4E92889260CDCF036F20B78D1F3E33C582CC80B741D96C6C5D85F947044BE1DF66962AB7E601BA912CDE0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

55F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\55F6.tmp
Size 1.9MB
SHA256 43c96e57d225c60bcf08687bc008cf4287ba7cb1724df66bafd3cfbb6a23b86f
MD5 756e0a1d7a58dcfe104a7492238ea3e8
SHA1 110240c23df224f8765d0c679895a5361aa4fcbd
SHA512 027efb5f79c0d26c228caeeece73e385042f90d7dd28eea17eaf4d6f61c9d3e7c112d8cdee20f31aed3118b98d91ea8d61e40dd895df69d74c0a382fbb59f12b
SSDEEP 49152:loa1taC070diR8BQSInqCoJz9UcsPeGnCOMzVmdScEBX8i:loa1taC0x8BmzoJpUznCOMzVcOX8i
TLSH
T1C6952221F791C1B2C0811971F5A1C3E69CB93D796A469C837BC80B7F2A64FC4AA72743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4192-0-0x0000000000400000-0x00000000005E6000-memory.dmp