03cdee1d4fc58e96c6f7082a3f92a1f1b0e7e97d6b4b08be8951a29e822f8df1

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_13ec040b2c8a09855db2ec9a39b9e4ca_amadey_elex_smoke-loader.exe
Size 24.6MB
Sample260910-ygsbfaxxev
SHA256 03cdee1d4fc58e96c6f7082a3f92a1f1b0e7e97d6b4b08be8951a29e822f8df1
MD5 13ec040b2c8a09855db2ec9a39b9e4ca
SHA1 3ca8c9de4a0db1165c38d32c855bf35db272261d
SHA512 e0185f972a6538736ae1160660aaa26bb9bc888070761a53de6dc3a156d4d77f37f76ba3d533d056f8fbc1d92c7a575efd156208a6d2ffd41957d604c9deff3c
SSDEEP 786432:puhS9oPPDSNBHJGDdzVXiOKbgFQWS4YldkV0p:pnzHQiOT+4okV
TLSH
T15F472382747D8414DE9F133988E18A7F7B1FDA4F87604EC7161F3E262A2D2C09679D86
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery vmprotect

Malware Config

Signatures

Detects executables packed with VMProtect. 2 IoCs

resource	yara_rule
behavioral2/memory/4048-0-0x0000000000400000-0x0000000003A9E000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/4048-1-0x0000000000400000-0x0000000003A9E000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4048-0-0x0000000000400000-0x0000000003A9E000-memory.dmp	vmprotect
behavioral2/memory/4048-1-0x0000000000400000-0x0000000003A9E000-memory.dmp	vmprotect

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_13ec040b2c8a09855db2ec9a39b9e4ca_amadey_elex_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_13ec040b2c8a09855db2ec9a39b9e4ca_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_13ec040b2c8a09855db2ec9a39b9e4ca_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4048-0-0x0000000000400000-0x0000000003A9E000-memory.dmp

Download

memory/4048-1-0x0000000000400000-0x0000000003A9E000-memory.dmp