4566b1c209ba1d2af6e5369543f90f0375614e2b130cd09246b62acd2da25f56

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_17ad2757a7b95514e1833b3bed57460b_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260731-xtnckser4y
SHA256 4566b1c209ba1d2af6e5369543f90f0375614e2b130cd09246b62acd2da25f56
MD5 17ad2757a7b95514e1833b3bed57460b
SHA1 3cb1fa9574554372e0fd5c4d667ff1bf7e2b6adb
SHA512 c0ba195cff6053e06c3125e6d54990fdf7f7e2b494ffa3fb0002471fd2326bd83abfb19f2cb1f165c06281a85d25c54cd47350163b242c50634ea16f1b978db5
SSDEEP 49152:+oa1taC070U8XM3CQAbLL1oWFMnjoAtGAs3bdLCEdR:+oa1taC0V3nAbn1tFHOs3hCkR
TLSH
T1A966BC50916AF3618A812930997EB159D4E5ADA483FD48F33D8C3AF9D773BE33532206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5484	555A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5484	555A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_17ad2757a7b95514e1833b3bed57460b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	555A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 5484	3284	2026-07-31_17ad2757a7b95514e1833b3bed57460b_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-31_17ad2757a7b95514e1833b3bed57460b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_17ad2757a7b95514e1833b3bed57460b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\555A.tmp
  "C:\Users\Admin\AppData\Local\Temp\555A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_17ad2757a7b95514e1833b3bed57460b_amadey_elex_smoke-loader.exe 764B86DA601E7836DBB5B8EC5FA68B902983C9AA8F619D279843CC3DB347070EE2286C19CBD261D7A08AE6533757461AF857F8266F74102D74CD48FB5BD0CDD0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

555A.tmp

Path C:\Users\Admin\AppData\Local\Temp\555A.tmp
Size 6.5MB
SHA256 ff59acd16ada795b4100ed15343e0ddc10a1afeb71346474e11a9f3b4a1252cb
MD5 e8c9ceba4f1b537126165f2f1f0f17cc
SHA1 96412fb19a6f80b9bbe130368bef49bbef891e6d
SHA512 3d7f2889cec3b14919c500fd2ca497411fbb07a2ae52cc61d29964c77892692c67cc21a10ba16470b1201b227bc01f2ce906c6013b421f7874bc01dd6b26743d
SSDEEP 24576:v2oo60HPdt+1CRiY2eOBvcj3u10Uv0H4auCnnS/YlDFPnNbVtGTN32hyqZ5g4f6O:+oa1taC070Uv37GS+PJnGTchyqZnt
TLSH
T1E166BC50916AF3518A802930987EB259D4E4ADA487FD48F33D8C3AF9D773BE33572606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3284-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5484-6-0x0000000000400000-0x00000000005EB000-memory.dmp