790b9a39ced262aa7ad3463d7480e4401da5c4813ec08f25ecc15e936d628716

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-rm127ssenb
SHA256 790b9a39ced262aa7ad3463d7480e4401da5c4813ec08f25ecc15e936d628716
MD5 c00750546bc655138d089dcfa7ae1e3e
SHA1 b15ff2a7fdbbe2e7a1f0186d4ddd11b499e1c0d2
SHA512 2e091d22be907106388572de90e2f22bd25101c6e41a3e383e1186225f5adfebcde4d0e11ab33e96222c26163a26feb4b252bc220dc9630c73203aa80d7a0a6d
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dfeXzZRyfMCyIxJ9C96GWd47hjK0J6cS8iw7t:Qoa1taC070dfe1RZIxfcZ3Pivs
TLSH
T15A952360F395C2B6D0910531A9A2C3F7D8693D7857448D873BCC2B3F2A64EC4AB75A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3664	C714.tmp

Executes dropped EXE 1 IoCs

pid	Process
3664	C714.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C714.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3664	3200	2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\C714.tmp
  "C:\Users\Admin\AppData\Local\Temp\C714.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe 0CE79144935E8661A0261DA390DB1B07AA34B5386A880077D28B31D859BD85C5C33177C4ADB01F58085055197D2C8190B35ECC43FA9532FB9154D80DD8C14677
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C714.tmp

Path C:\Users\Admin\AppData\Local\Temp\C714.tmp
Size 1.9MB
SHA256 d35de16839003da9c1f49b77bfb3c33dfe2d1e689f0b025599d1f17eb50ad8e4
MD5 3a5be8a21b403f19f891d08563238185
SHA1 55b35037bdc56bc30fef886c250f1e79c8fb4035
SHA512 d04bdead5e47fd04cd4f3ee4ac9125302462e3dec2ab888b39cb2d2aa25d06e76f8957b04bd121bef0f39e91a4cab1b747053df126518275a52fe00cbab89a98
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dKHGDrZ3WrtOtlCkW/IiEM3xGBRnbqTNK0HMl:Qoa1taC070dwEroBkLwPBRMzSvc
TLSH
T168952360F7D5D2B2C0820675E6A5C7E6C8793EBC56458C437BC82B3F2864AC06B72B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3200-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3664-6-0x0000000000400000-0x00000000005E6000-memory.dmp