1014dd79f8a76972e1110a64eb3b3add8b5bbf2757ce8f6182debb75b7c5f502

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_5a5936dfc9fb42c687384eace29ed117_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260801-zza1jsxxg1
SHA256 1014dd79f8a76972e1110a64eb3b3add8b5bbf2757ce8f6182debb75b7c5f502
MD5 5a5936dfc9fb42c687384eace29ed117
SHA1 ace168e9b8fa4e143c8ee4304bb446130c8db3e9
SHA512 28147302d504420a7b2a68f8d36bab14490862d0ca35cca63540ec2c666cc4aee0457a222d7d419f848f00a6a3b12a7a2334b650f062642495312b118179fd45
SSDEEP 98304:+mhd1UryetZrmsvJjT0HBgjVLUjH5oxFb:+lNZCsx0HBmVUjZE
TLSH
T1F6262350B791C2B1E08574FA648343EB8A747F7C56219E8B6FCE261F9C64CE1B636243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3560	1469.tmp

Executes dropped EXE 1 IoCs

pid	Process
3560	1469.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_5a5936dfc9fb42c687384eace29ed117_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1469.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3560	4256	2026-08-01_5a5936dfc9fb42c687384eace29ed117_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_5a5936dfc9fb42c687384eace29ed117_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_5a5936dfc9fb42c687384eace29ed117_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\1469.tmp
  "C:\Users\Admin\AppData\Local\Temp\1469.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_5a5936dfc9fb42c687384eace29ed117_amadey_elex_smoke-loader.exe EEF1D00F38ABA320DA4C1CBFAC5B2CB328E105582D8CA5D3A85DF5FCBACC958904CB7ACFAFEC58A3E4FFA845C37B10A7572A838C28B11164509175F5995A0AFC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1469.tmp

Path C:\Users\Admin\AppData\Local\Temp\1469.tmp
Size 4.2MB
SHA256 a81f273b6ac584023e320dc993835124b41bf0fd9955c3fc261fd4f138bfcdd5
MD5 3722376878856d13c3ceba1a8d80f16d
SHA1 bfad893a873efd309672a7ac4d505baf50ca8e60
SHA512 ff8a5a2d18fc8bb8eba80f1cc72c33059cd2027c8fc99271a78ceebe174ef00c4d13324cd65d71c7f459e2ef7af8bca5581d646cb6bef937624c73cee81b69ea
SSDEEP 98304:+mhd1UryeprAeNk0W/DUMYDG7cGVLUjH5oxFb:+lJr5NklUMYDMcGVUjZE
TLSH
T1A7262350B7C4C2B2E08165FD218383C799787EBC5265998B3FCD2A2FAC64DF56735282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3560-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4256-0-0x0000000000400000-0x0000000000849000-memory.dmp