2dab502e08d344a40dff834b3951b777ede5cbdb4c8ed1b08971a003d739ec4a

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260801-tyv2fade64
SHA256 2dab502e08d344a40dff834b3951b777ede5cbdb4c8ed1b08971a003d739ec4a
MD5 8583890b4941487234b1b81bf0eb8645
SHA1 222f16a6e319c163d0768b7785050c6e2e84377f
SHA512 c59c29bf970d97ea9ab84566352754d8e188c03b1fa671941c2ff8ce1ee4ef94b2af67622c9e2091ae737e38bec0f1e8d38efe75bf0a0d8929e02c5efa926af0
SSDEEP 98304:emhd1Urye7KKs2bZpt/hD7YaEwD11VLUjH5oxFbxCVLUjH5oxFbx:elbP3nlhD0aEU1VUjZEdCVUjZEd
TLSH
T1E6262341F7D4C361D0C275F9508383EADA343F6D566A964B1FCE2A2EEC788E176B9102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
240	400D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	400D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 240	5372	2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Users\Admin\AppData\Local\Temp\400D.tmp
  "C:\Users\Admin\AppData\Local\Temp\400D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe 985718FF63F4D9246A606320E3505750AE70C807E97BAC1D7518AEC3588409A236400C5D1ECB0278368E5D3D0D71C7B66AC727DC5B4FDF5B60DD10EE0256D286
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

400D.tmp

Path C:\Users\Admin\AppData\Local\Temp\400D.tmp
Size 4.2MB
SHA256 f63447b655dcf7f26ca3693375b34f8b5ce69d820c532ada0cc9f8851deed1cb
MD5 6e37a81dc29adeb0c0b3c6ac3fe72831
SHA1 d4a9bcab144b3efb3a00958764758220f60ef933
SHA512 495491c24f611c5219d71580a3ceb9c6e9afd2eb5f9632ecaec64e763e8946dceafa3ecacd0ea438a8a723f092563bcb60275a5c0739d7ca77f877da6b682119
SSDEEP 98304:emhd1UryeTef9Fhf5bp0WMzLSkVLUjH5oxFbxCVLUjH5oxFbx:elzeft5bszmkVUjZEdCVUjZEd
TLSH
T14F262340BBD4C6A2D1C235F9608387EAD5743F2D1576A58F6FCA2B1EEC688E17274243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5372-0-0x0000000000400000-0x0000000000849000-memory.dmp