0b8d81351f78c3576dedb3fa95dce309aa81adde6ed5d5d7d23c0b72d58dc969

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260716-e5aazsgv8v
SHA256 0b8d81351f78c3576dedb3fa95dce309aa81adde6ed5d5d7d23c0b72d58dc969
MD5 4424f7675d4455941966b28136f32f28
SHA1 f5fee17b4ff8fea60e5ad6315efd1a7852b3f873
SHA512 725a2dff245398eb13403098914ea3d9c67a86c186d7de51e0557003b9867bd54a9f22ccff9753b7d9ba1c41797e99c0e59576ceed8dd36c69424d533809368f
SSDEEP 49152:Svm2AC0d1XqrdryeJVW8QmxQKy2QQ+YDZZEgmyYZo/wLVT5dVXeQqZUhh4r5VC9j:emhd1UryeS8Qm5WamFV7wQqZUha5jtSn
TLSH
T1CA26D00996FCDA2CCC1F51F4A1A51145C7F0A564EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4296	DCBF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4296	DCBF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DCBF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 4296	1164	2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Users\Admin\AppData\Local\Temp\DCBF.tmp
  "C:\Users\Admin\AppData\Local\Temp\DCBF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe 82E6D06652DAD1F54EE1E78D074A256E99AF858A6461C83439C2569FCDDA4D89E090063F9EB81B6CF07DD7E50FF0E99CB9C6E85D465C1EE11D293603579B743D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DCBF.tmp

Path C:\Users\Admin\AppData\Local\Temp\DCBF.tmp
Size 4.4MB
SHA256 41aada9793937f46204f3c7a45ee7f77a16009bea1370c6e84ee549be39ccd06
MD5 0872f0e792bc947027500b19b63316c0
SHA1 c4c22ba0e81f5b5a613470488e553dbbf46aa739
SHA512 1daee0e7a331c60263c03cc49250f40e392fa2e5430bbd169e54bc01ba6724b8440f3ec0bc920c9510df982e7920cccaf5f1b475e6c4d3886cd90723cb795f0f
SSDEEP 98304:emhd1Uryeo1wFO/5xE7fV7wQqZUha5jtSn:elIwy6f2QbaZte
TLSH
T16526C00996FCDA2CCC1F51F4A1A51145C7F0A524EBD3AF997DA2F1F02A823A4B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4296-6-0x0000000000400000-0x0000000000849000-memory.dmp