c743fd86d9943ae13023ba5c3f2fa503d257bd4fc06e61d20f31051ca8f846d4

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_32612354c9c3bfbb00f6905bb142d448_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-vsc44ssarc
SHA256 c743fd86d9943ae13023ba5c3f2fa503d257bd4fc06e61d20f31051ca8f846d4
MD5 32612354c9c3bfbb00f6905bb142d448
SHA1 a51892da3dd9aa063b6384168866ab6918d99a77
SHA512 cbbf08e62929d61bae732151c6d2a593cfab5baf221473ae23f392145981cefae46f070b2796d59d0d7394548c8d2bc2976b1cd2a650c232933adc16c0bec628
SSDEEP 49152:Qoa1tLC070rLLHnBXAx4M6ivbEqLr/fYY:Qoa1tLC0IdXC960AMr/
TLSH
T1A29522A4F7D0C2B2D0811A34A491D3AADCA97E7C06418C577BDE2BAF2D94EC05B75B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5860	AC73.tmp

Executes dropped EXE 1 IoCs

pid	Process
5860	AC73.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_32612354c9c3bfbb00f6905bb142d448_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AC73.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 5860	1724	2026-08-01_32612354c9c3bfbb00f6905bb142d448_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-01_32612354c9c3bfbb00f6905bb142d448_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_32612354c9c3bfbb00f6905bb142d448_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\AC73.tmp
  "C:\Users\Admin\AppData\Local\Temp\AC73.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_32612354c9c3bfbb00f6905bb142d448_amadey_elex_smoke-loader.exe C997120DCBCE7CE49313D40F0971E03F660B41EBDAF5C16EA594B58CA762D2E7B049DF07F3B807EC54E3F43CCC785440880653785B2A7EFB18BF7B57D8530864
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AC73.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC73.tmp
Size 1.9MB
SHA256 c0322fd62f82caedfa0b2a56c81f27a85fd61c043588dfe23cce90d84c66b553
MD5 96a265f1daaa6760a778092e9489b399
SHA1 2a789e86059cfd30741d9d50f95757e680653db1
SHA512 a692fa5189ae048c5fe7542a5db8fa4bf2297e01caff7c70fe4d1d63b1686e8276a6a699cd0f8a88f4ce79bf991d51b037237eecc85ca2940ce8e33764c288dd
SSDEEP 49152:Qoa1tLC070rbbFSWnFOzrpXC40cseOn4quRGsGp+XzfnYY:Qoa1tLC0k4WApS40c8uRGsG
TLSH
T169952350F791C2B2C0C20736A591C3A7CCA53EB857419D97BBCC1B6F29A4BC05A3AB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1724-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5860-6-0x0000000000400000-0x00000000005E6000-memory.dmp