85d73fc35e1a2c8b812484692c5e57daab97bffa9a0a1d9988bccd8622989647

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_afbecb962771df9ddd67ef4e54668acd_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260801-qapyqsba34
SHA256 85d73fc35e1a2c8b812484692c5e57daab97bffa9a0a1d9988bccd8622989647
MD5 afbecb962771df9ddd67ef4e54668acd
SHA1 11202c0cfb42df5d6ca3c2d58db84da6904c534e
SHA512 804660f8752bdf456316ba835d2d1394ce7502bc92dfdad23a7a62953f50b89a584516c7c54f94d52d0477c68d5fcd8dc6ca64e7a18dd03959a11ec90c452169
SSDEEP 49152:+oa1taC070UTkDFAiEApaShnhZzt917XRA:+oa1taC0qDFAen9zXRA
TLSH
T1C566CD50916AF3618A802931997EB259C4E4ADA487FD48F37D8C3AF9D773BE33532205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2156	D64.tmp

Executes dropped EXE 1 IoCs

pid	Process
2156	D64.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_afbecb962771df9ddd67ef4e54668acd_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 2156	3880	2026-08-01_afbecb962771df9ddd67ef4e54668acd_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_afbecb962771df9ddd67ef4e54668acd_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_afbecb962771df9ddd67ef4e54668acd_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\D64.tmp
  "C:\Users\Admin\AppData\Local\Temp\D64.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_afbecb962771df9ddd67ef4e54668acd_amadey_elex_smoke-loader.exe 9BAAD01381C0AC22888EA26A70E6809791208404E717C185A91609AEC8DE2A5476CFC0A3DEE7279028440AE49C9576174014B5ECD863253B63277417C3363CA0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D64.tmp

Path C:\Users\Admin\AppData\Local\Temp\D64.tmp
Size 6.5MB
SHA256 3b23481402d42e6e9f551491f76e098e464576b68375ea08e16e7a9ef63bffb1
MD5 7f43ca0b9accef2e72e28e46268cd333
SHA1 54774c44099a2261a9c7e458db30fcc943d00e33
SHA512 a5b43196b6ece7db4cb3c277d16a80690aa9080ecd1427aa72d348feeb7d2e58a12c32631ebe5385780f9cf207350354af6a03f5e64d1e5fde9d471b06b7686c
SSDEEP 49152:+oa1taC070UlJPf2oe7OWRTAMh3zF3+wi:+oa1taC0h32fSW9fzM
TLSH
T1BA66BC10516AF3618A812930987EB159C4E5ADA497FC48F33E8C3AF9D773BE33536606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2156-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3880-0-0x0000000000400000-0x00000000005EB000-memory.dmp