ea953639ce35b56fa75ec835b9f69bfc05d4efd52b82186723b0e1da0bf7e914

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_387303384039b32f578a024f2b92fa7a_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-1jffrsxemb
SHA256 ea953639ce35b56fa75ec835b9f69bfc05d4efd52b82186723b0e1da0bf7e914
MD5 387303384039b32f578a024f2b92fa7a
SHA1 080e0f231ec24a572ae79cfba3022035fa8f4d38
SHA512 fc6ee9745a68fc2912c2a9bb10e3dc92c9fb39136d8b55fb86d84b87925f94c00596e201b81ed92b5e3348755075f12b45ad02e4a69912dfaea57686b6c4582c
SSDEEP 49152:boa1taC070UmJW3a0kzRRrjYal4jNUK8D0iTXmVe:boa1taC0gAK0GRRrHS6K
TLSH
T1AB952310F7D4C1B2D0C10671AA91C2E7DCAA3EBC92525C47BBCD1A6F29E0EC46A72757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5336	2929.tmp

Executes dropped EXE 1 IoCs

pid	Process
5336	2929.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_387303384039b32f578a024f2b92fa7a_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2929.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 5336	1620	2026-08-01_387303384039b32f578a024f2b92fa7a_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_387303384039b32f578a024f2b92fa7a_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_387303384039b32f578a024f2b92fa7a_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\2929.tmp
  "C:\Users\Admin\AppData\Local\Temp\2929.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_387303384039b32f578a024f2b92fa7a_amadey_elex_smoke-loader.exe B140684D6F92311DBA22D1299BECB37F8CFA6713DCD451E29A6CE20EA21FD197A8CF701D9A9343F68663973FDC9DE78DA25768D1AD1A67DD2BBB411F18CE62E5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2929.tmp

Path C:\Users\Admin\AppData\Local\Temp\2929.tmp
Size 1.9MB
SHA256 7ea6763dc2a6a39459b117a105c8eade09db68a0c1935d15514b2769f1693fd9
MD5 2ff5762d85163af593dd93578d50e951
SHA1 b2c04b76b542e33795b5eb26e33e6bbd912b2023
SHA512 590474a3d2c301e9c2d38bd8a3a3df724a2dca5600e5e2047fb5d56c0be73ee43979d68883ee5aa0caee047f26c570ce192f3d3eea1daa6df38dd17f25f39f95
SSDEEP 49152:boa1taC070UUn8gvwp65SiepL0R2w0ehWDdx:boa1taC0qjSXJjw3s
TLSH
T17D952351E790D2B6C0C20931E692C7E6A8B63E7C5A418D437FCD1B7F29A0EC06A7175B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1620-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5336-6-0x0000000000400000-0x00000000005EB000-memory.dmp