39167d7ed75076e7612a41a152e49b6b7dabc322ab67da928cb28a75eda263f9

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_d330ab9259e1c1f2dd3746f85633c6e7_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261107-2ch4rafy31
SHA256 39167d7ed75076e7612a41a152e49b6b7dabc322ab67da928cb28a75eda263f9
MD5 d330ab9259e1c1f2dd3746f85633c6e7
SHA1 8cd5e8c8c7aaf689d3bb1adcddf383b4cc9b8b76
SHA512 42ff5874cc3e3d590779334193beb275c12fc49c303f321ac3af645e253607d963a7d1719d3d906111a52ee1760841b71dded0f415d9086beb4f725272903f0f
SSDEEP 24576:S2oo60HPdt+1CRiY2eOBvcj3u10U793on+TyH1TtZEDaoBiVryiugCCaGSob0Ggl:boa1taC070U78Hp78+rydl7A0GsH
TLSH
T10E952360F394D2B6C0910A719562C7EB9C29BE7C56018D937BC92F3E1A61EC06B71B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3260	CA7F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3260	CA7F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CA7F.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-06_d330ab9259e1c1f2dd3746f85633c6e7_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 3260	1760	2026-11-06_d330ab9259e1c1f2dd3746f85633c6e7_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-06_d330ab9259e1c1f2dd3746f85633c6e7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_d330ab9259e1c1f2dd3746f85633c6e7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\CA7F.tmp
  "C:\Users\Admin\AppData\Local\Temp\CA7F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-11-06_d330ab9259e1c1f2dd3746f85633c6e7_amadey_elex_smoke-loader.exe E0A430CE99C625915FD59A1D6E2E445968392AA77A552174E1A3D35A6F3C00BF10A486E6F6C01EC31896AADFDEA80B1F7C146615FF4CD7D5602E818F11FDFF60
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CA7F.tmp

Path C:\Users\Admin\AppData\Local\Temp\CA7F.tmp
Size 1.9MB
SHA256 d7fa4239fd27de21c0c3e6044695f9e18b63dc0ecf2c63d5c586efeba8aa9212
MD5 4282e12c70220e89c56e5343f5577489
SHA1 fbd2f9a1ebdf3347318a8de8726fae04b2fd3f78
SHA512 ccba4874aeb706bf46bae847c6eb3637ff332ad266b7d37c1af6b8a52d8cf16556130891101144f830573409f63cdf3ee168895b4455a05b43aff248530611ef
SSDEEP 49152:boa1taC070UqDDQjzFJ4IWkaPZcUg4CM9b+lW7DkV:boa1taC0H5KxhcUQ+yIE
TLSH
T151952310F395C2B2D4C116B2A652C3E298797EBD56914D83BFC9277E2C90FC02676B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1760-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3260-6-0x0000000000400000-0x00000000005EB000-memory.dmp