354db1e1568a45e3ba6f4818b8488c3d3475a268dd19863cf86757b9aa3c45be

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_eb74b45e72967ad4da0df0aa1b7c30ce_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-pp53tsvfne
SHA256 354db1e1568a45e3ba6f4818b8488c3d3475a268dd19863cf86757b9aa3c45be
MD5 eb74b45e72967ad4da0df0aa1b7c30ce
SHA1 9be8183c2555e931e246edb2b1bd742b9805aae3
SHA512 aa79ab5b84308fc322c7403aefa96041feeb24f92ae5f5f52322465fa4cc0a697635ae42726ca3fe88b676ad4b7f9537f1c7b42080cdb215ce92f1d8ea1d457e
SSDEEP 49152:Qoa1taC070d9wsHKx3b1Kg13IxO2WdUsI7mIFqa:Qoa1taC01sHKB1KglIxO7GmIMa
TLSH
T1E59523A0F795D2F2D05106B1A5A2C3A7D8293D7C97458C877BC81B3F58E0FC4A921B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1520	DFF6.tmp

Executes dropped EXE 1 IoCs

pid	Process
1520	DFF6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_eb74b45e72967ad4da0df0aa1b7c30ce_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DFF6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 1520	3516	2026-08-01_eb74b45e72967ad4da0df0aa1b7c30ce_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-01_eb74b45e72967ad4da0df0aa1b7c30ce_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_eb74b45e72967ad4da0df0aa1b7c30ce_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Users\Admin\AppData\Local\Temp\DFF6.tmp
  "C:\Users\Admin\AppData\Local\Temp\DFF6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_eb74b45e72967ad4da0df0aa1b7c30ce_amadey_elex_smoke-loader.exe CC938F5DCF4DE911A3CDAFE082E3F6FFA696EAD0DE614E7FBE1DE35C29D6EBB9253739744108E35889314449E061DA0C9E3E0B0E47A6B39787445AE71F14FA53
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DFF6.tmp

Path C:\Users\Admin\AppData\Local\Temp\DFF6.tmp
Size 1.9MB
SHA256 7ae210543daea39b4f2c3b6f91a3d78cca8bf466e5602793a234027312feec57
MD5 460f28e74c4fd110223cd8d57ad57a42
SHA1 691d6b63bcbc02f4be667e1220a1d827df64ce28
SHA512 68b4913dd0637abeb27fb9d304163475b6e5691a93f1a541a83cbf548cd7da90ab3da1a7b528bef5eeaacb05dfcdda506207fad1c84c877cfef612a33e9730d0
SSDEEP 49152:Qoa1taC070dQLeWmGSlmTnm+nc/dPX5GE:Qoa1taC0KW95Rc1PX5GE
TLSH
T1D1952210F690C2B6C4814675A2A2C3E7E8B57E7C46068C877FCD1B3F69A0EC46A76717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3516-0-0x0000000000400000-0x00000000005E6000-memory.dmp