c7d0f3162670fd6b2feec6f0a329a4727edcd0a549ef6a6e0f425a0277b4eccc

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260802-xt892see97
SHA256 c7d0f3162670fd6b2feec6f0a329a4727edcd0a549ef6a6e0f425a0277b4eccc
MD5 2ef67f5acb0a0806a57b066ee7dbda33
SHA1 689bb7a55b37c614fed712b527c648572f8a5690
SHA512 be41f7c8e092f3e4bce7405a92efef69bbf1b3ee6466a713f743f34d59f25b6eb364b605cdfa8331ad94047c4d59d7f748f4cb1bf2b859ee6c331debc2b38ae4
SSDEEP 49152:foa1tqC070XlLfER5TQbYLeKaQDMhoO4lz:foa1tqC06gFQbYjah
TLSH
T14CA50200A3E68171F0B3663199B282519D773C7867F19ACB2EB4DA1E1E71BC09D75B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3124	C6A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3124	C6A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C6A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3124	2872	2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\C6A.tmp
  "C:\Users\Admin\AppData\Local\Temp\C6A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe 01B715EBBC97974A64FEBA570CE46670521D951163BC5E4A901123CCC1D9C6384F51CB8537B9FCBC72315721B231EF71019C201A87223B5B8F1DEFF28708FFC7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C6A.tmp

Path C:\Users\Admin\AppData\Local\Temp\C6A.tmp
Size 2.0MB
SHA256 d422697990443b479b8a16bd25050202bcd153eda257df1643fd1d96aef9ed39
MD5 e08ef47232204e5c43e0c38588c9b964
SHA1 4ba6aa3a57251ffdd9958bcfe4cc2ee347aee280
SHA512 d21961db6c4fa20fec42d7f854552639e3f83cab49e3c9ef7ac53c7b84ed8f91935387dde86c30529ba29bafa496d8942d9395981687ce49058698db143e85c9
SSDEEP 49152:foa1tqC070X1a1yvUADrT08eK1koKYkcgMCWWEZlz:foa1tqC0Ga1yMAD//CBFdW
TLSH
T1A0A50101B3E68175F4E20630A9B282519D773C781BF199CB2EB8DA5F1E72AC09D75723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2872-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3124-6-0x0000000000400000-0x00000000005E6000-memory.dmp