1435f55d00cfd16a50ac1ab2b664a7dda83ed0d958ac8825e194734d25272624

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_10945a0ce2884d6dd9e3dbb26a711234_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-v481xssdpg
SHA256 1435f55d00cfd16a50ac1ab2b664a7dda83ed0d958ac8825e194734d25272624
MD5 10945a0ce2884d6dd9e3dbb26a711234
SHA1 21d99a7e316785c1bbdf5279e4c5f69c5595600d
SHA512 73776a78d41cf534915012aec38248a4e2df05199ff5859fa14692980a977da32426eb01355d01f1f2fa39cd43ea652519521afebedadc15d99e8d0ab1979332
SSDEEP 49152:toa1tNC070sgk0G+IFZPvhPCov/UxQAg1KKfdDC/:toa1tNC0VznhqHq9fC
TLSH
T1AB952260F395C2B6C4920670A6A2C7BAC9B63EBC52468C837FC91B2F5D50FC46A31757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3792	AA5F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3792	AA5F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_10945a0ce2884d6dd9e3dbb26a711234_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA5F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3792	3700	2026-08-01_10945a0ce2884d6dd9e3dbb26a711234_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_10945a0ce2884d6dd9e3dbb26a711234_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_10945a0ce2884d6dd9e3dbb26a711234_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\AA5F.tmp
  "C:\Users\Admin\AppData\Local\Temp\AA5F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_10945a0ce2884d6dd9e3dbb26a711234_amadey_elex_smoke-loader.exe D8D01F78B42295B7A71FD8C322CC61ED5A9D60058D65176700AD36A48C9F6488E6EE5ACD635190FF1EE2B6E34D5C60F02C07B95712A13CB0854CF20F0BC38971
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AA5F.tmp

Path C:\Users\Admin\AppData\Local\Temp\AA5F.tmp
Size 1.9MB
SHA256 e7032edb9aad34fc8e33fef0fe281bc8fa3946a5d08fbac81971be8056136d2e
MD5 2aa91acd389b1c70971b3569bd283bce
SHA1 0479e025a04f8ec77b5e85fcdd72c8cdfaa60736
SHA512 5a29bc5f6a1affb05f87eb6cb0e3ba1772cd0f122055566ad383fd782f9eb1c5faf716a71f63f90e3db444200acd1e9db06c029837120fdd2256e39bf916728e
SSDEEP 49152:toa1tNC070sZMj7vhkC3cadjj8x4EqQV9AFsEm7:toa1tNC0vMjlkCtgSEn9AFV2
TLSH
T198952290F798C2B2C0820971A151C3E6DC797EBD56069CC3BBC91A7E2DA4FC05A76B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3700-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3792-6-0x0000000000400000-0x00000000005E6000-memory.dmp