a34d404198e3db4f618d1792d9c6bd5ce3ab8aa987ce0fbc1d678ff82f5446d6

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_e1c2c656c43e5d6f3f7a3bce32f9b31c_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-ps96ysbj2y
SHA256 a34d404198e3db4f618d1792d9c6bd5ce3ab8aa987ce0fbc1d678ff82f5446d6
MD5 e1c2c656c43e5d6f3f7a3bce32f9b31c
SHA1 51321819a1cc8c4c384004d000aa058cc3342d85
SHA512 f342c0a69ed7e9e799f8156b97c2654d2f14d44acf9b1774a3f825b2c42d880bfb6f8ef937dff9f0368740812e3c7f38195154bc15cc5f63fc49d850101bbacf
SSDEEP 49152:Qoa1taC070ddkpAkqWr4j+Yu/oaB2n24xmO1o:Qoa1taC0af+4jDuAz24x7o
TLSH
T189952251F684C2B2D0810671E652C3A3D8793E7D56958C83BFCC2A7F2EA0FC06A65B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6500	89F6.tmp

Executes dropped EXE 1 IoCs

pid	Process
6500	89F6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_e1c2c656c43e5d6f3f7a3bce32f9b31c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89F6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 6500	3376	2026-08-01_e1c2c656c43e5d6f3f7a3bce32f9b31c_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-01_e1c2c656c43e5d6f3f7a3bce32f9b31c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e1c2c656c43e5d6f3f7a3bce32f9b31c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\89F6.tmp
  "C:\Users\Admin\AppData\Local\Temp\89F6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_e1c2c656c43e5d6f3f7a3bce32f9b31c_amadey_elex_smoke-loader.exe C9512D4D9B5A40DD9F46A012817FE326300FF455E947849909C14A4486B83B4F456C07DF19967225BCB82807BBC6315C53A9B775CB66AB12C01DAA8CEBF64D22
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

89F6.tmp

Path C:\Users\Admin\AppData\Local\Temp\89F6.tmp
Size 1.9MB
SHA256 b9928d7b55f76943ab585e52275d06b384261f3e2e384a41eca8d8040a7d4515
MD5 095f82092c68c4fc6eb661f4805f7db7
SHA1 bab717b2e679d8d0c2582c2212cf652fe99b0d4e
SHA512 fe45806280bf0278a72a9fc9223db7c1d2670d94596dd64faeb1706d4171e6a7ca2b766642d2b7beac0a24feb025b15b8593e587065efc78ec378e83108ed4ec
SSDEEP 49152:Qoa1taC070dl8Zj0LMV2W3d4HhfIESAaIIChohja+4Nz:Qoa1taC0NZ8MUsKhQ1jDh1yz
TLSH
T16B952351FB85C2B2C0814671F2A187A2D8B93E7C5A429D837FCD1B6F29A0EC45E71B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3376-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6500-6-0x0000000000400000-0x00000000005E6000-memory.dmp