Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 16:28
General
- Target 2026-08-01_84cedd0581b13e4eb65a41e6d9192c38_amadey_elex_smoke-loader.exe
- Size 2.0MB
- Sample260801-ty25rade74
- SHA256 f3d3a02b74249e30fc261d62f2bcbb6e803351b7700206036ce6ed948b0e9815
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_84cedd0581b13e4eb65a41e6d9192c38_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_84cedd0581b13e4eb65a41e6d9192c38_amadey_elex_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\D037.tmp"C:\Users\Admin\AppData\Local\Temp\D037.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_84cedd0581b13e4eb65a41e6d9192c38_amadey_elex_smoke-loader.exe 9BD17BFA7D5437A1B63B4DBA44F5597D855E835B674A9AA4D7A62329BB14F8441655E6A2D40A976D8292F29494B191FF4C1C00071A672B2852DEB3ABF9757B432⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D037.tmp
memory/1808-8-0x0000000000400000-0x0000000000601000-memory.dmp
memory/1808-9-0x0000000000400000-0x0000000000601000-memory.dmp
memory/1808-10-0x0000000000400000-0x0000000000601000-memory.dmp
memory/1836-0-0x0000000000400000-0x0000000000601000-memory.dmp
memory/1836-1-0x0000000000400000-0x0000000000601000-memory.dmp
memory/1836-6-0x0000000000400000-0x0000000000601000-memory.dmp