c18fc11ade441a0fee9b14fc6e7272f7c595ac2d8c020667b35ebe948544b359

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_e002c61f7b2aeb0f0e48230d1cae5f5b_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-pt342azscx
SHA256 c18fc11ade441a0fee9b14fc6e7272f7c595ac2d8c020667b35ebe948544b359
MD5 e002c61f7b2aeb0f0e48230d1cae5f5b
SHA1 eb4125527ffcbbff3d54942402e4a06e2de17b5a
SHA512 ec70db39b1ae69d1cb3382c56ad4a701afe0c4b3f2b6f057b0c349fd543e9cebacdc68b820a100cfd767b4b919f844f48e78420726ae771071102cd44af30a32
SSDEEP 49152:Qoa1tLC070ra5xNRTBvRlr+S8HzgKFv1zGdGSV5/RpRCkaYY:Qoa1tLC07nzBv/rmzn5ZGdGS//XRCk
TLSH
T197952221FBD4C1B6C0C11A74A591C7A39CA43E3846159DD37BDC2B3F29B4AC0667AB47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5868	7F77.tmp

Executes dropped EXE 1 IoCs

pid	Process
5868	7F77.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_e002c61f7b2aeb0f0e48230d1cae5f5b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F77.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 5868	4560	2026-08-01_e002c61f7b2aeb0f0e48230d1cae5f5b_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_e002c61f7b2aeb0f0e48230d1cae5f5b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e002c61f7b2aeb0f0e48230d1cae5f5b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\7F77.tmp
  "C:\Users\Admin\AppData\Local\Temp\7F77.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_e002c61f7b2aeb0f0e48230d1cae5f5b_amadey_elex_smoke-loader.exe E19EAC2FF6F6C90C6220DBA58FCBFC1A667C68DE196E456AD9215AD4FC0AFDEF8CE27D6E4C1ACC613572254FAAC10217E4BFA0C01D23B2471462697BF099E202
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7F77.tmp

Path C:\Users\Admin\AppData\Local\Temp\7F77.tmp
Size 1.9MB
SHA256 2df544acbc1176a8392d820d1d5092943250ce4ff564b35cf4374dddcb2f1559
MD5 4d06ead4661ed3c0dfdc8f3cd51b7d48
SHA1 94378f1cece4ecae17b463d784e6e90af716113a
SHA512 77cac7225f294bc72fe12f1e75232df73865e87b1457a9401fa69c7eb99f9e0f25a1d1d5250bbac8e5edcb473399c167f2e96b8b57452ccccf5944557d802f8f
SSDEEP 49152:Qoa1tLC070rCt1SknVc4NS8lB0CHyz71dmC6jzkQ5Yv+jYY:Qoa1tLC0l1PVc44PCHyXnm1zkQ5
TLSH
T191952211F391C1B2D0C10736BA92C7A79CA93EBC06518D977BCC2F2F28A4EC16665B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4560-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5868-6-0x0000000000400000-0x00000000005E6000-memory.dmp