73199b74b289f2eb79fbe1f5ea64243db581a1a3379b82bd0f31d0f11ca5c893

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_3a5dec08a07b3ec5875bcb5b5655e235_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260801-1hta8sysbw
SHA256 73199b74b289f2eb79fbe1f5ea64243db581a1a3379b82bd0f31d0f11ca5c893
MD5 3a5dec08a07b3ec5875bcb5b5655e235
SHA1 2a6bc715e46a2208ae9ab4c1da3c34af1cc1f6d5
SHA512 9b9d542d6093435dc9c936d527b7265639df63d855dcee0c25bd9874fda54a55b8c7936533783daafee3b6a31a1793c251be3889dc86d7c6a0ff5f293a75bdf5
SSDEEP 98304:emhd1UryePNSpM57IkdV7wQqZUha5jtSn:elvNS+lIkd2QbaZte
TLSH
T19D26D00996FCDA2CCC1F51F4A1A51145C7F4A524EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1416	8718.tmp

Executes dropped EXE 1 IoCs

pid	Process
1416	8718.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_3a5dec08a07b3ec5875bcb5b5655e235_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8718.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1416	5052	2026-08-01_3a5dec08a07b3ec5875bcb5b5655e235_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_3a5dec08a07b3ec5875bcb5b5655e235_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_3a5dec08a07b3ec5875bcb5b5655e235_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\8718.tmp
  "C:\Users\Admin\AppData\Local\Temp\8718.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_3a5dec08a07b3ec5875bcb5b5655e235_amadey_elex_smoke-loader.exe 2F5B157FB8C3957DAA3BDD5A869807F08E1774349D4CBD06385B2340EA00D5F879837C3CDBC10D82BD95B2B5B495F38B962B5221875AB742F061D4EE547B8C59
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8718.tmp

Path C:\Users\Admin\AppData\Local\Temp\8718.tmp
Size 4.4MB
SHA256 3f4126e68b99370ddce53e0bf5d5b25b0c2caae53023d9a3c5d560ac060788b6
MD5 87f65d1f83b5235b3ef6a8770438f090
SHA1 b2d9720406c6a6609ee1cf5632f04072d19abc73
SHA512 b5365a53e7c348f490bef9a6b135cf1938fb6005dd6bce8c14186ff932d42520eadb7276c2097d60436151d5122d586fb90965240c3f6d1088e5325e1164269d
SSDEEP 98304:emhd1UryeReToGNqB2hs4CrV7wQqZUha5jtSn:elqoBQsbr2QbaZte
TLSH
T1B626CF0996FCDA2CCC1F52F4A1651145C7F4A524EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5052-0-0x0000000000400000-0x0000000000849000-memory.dmp