c8cc6558d8f7e4296edf28336814a7b94b4e9b6d8c1c19387b386068ad175e8c

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_51740264b8b94deee818472905af25e7_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-a4cbqs1clg
SHA256 c8cc6558d8f7e4296edf28336814a7b94b4e9b6d8c1c19387b386068ad175e8c
MD5 51740264b8b94deee818472905af25e7
SHA1 e1c86d06252ed5a2c06af5955737f7616cc1a815
SHA512 916d0c4186c2fccb50b3bc70fbfd5ce3538f243d355a00e67e07917d3de5d3206a6298294f4608ca32734b3b6707f03676696d1867522170b70e873ed921c815
SSDEEP 49152:Qoa1taC070d3TW6m1XdkhBqqP9Z2fToXfwiVAZ:Qoa1taC0Xtkh39qToX4iVG
TLSH
T1C3952354F7D0C1F1C0820571AA91CBF3E8767E7D9B518C47BBCD1A2E1A90EC46A62B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4844	D80C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4844	D80C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_51740264b8b94deee818472905af25e7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D80C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4844	4148	2026-08-01_51740264b8b94deee818472905af25e7_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_51740264b8b94deee818472905af25e7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_51740264b8b94deee818472905af25e7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\D80C.tmp
  "C:\Users\Admin\AppData\Local\Temp\D80C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_51740264b8b94deee818472905af25e7_amadey_elex_smoke-loader.exe A2BB0737A6A2F31D0320E7A99DAA1EDEEF3066BDAC8ECA1E216637CEB989110FE7C8CB624EB2A4208BAE382BB9A40B75B514ECA34BB5F2B8C3C0C9A03FA7F3AC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D80C.tmp

Path C:\Users\Admin\AppData\Local\Temp\D80C.tmp
Size 1.9MB
SHA256 81df059a98dda1c94af33101bf3eaabea1e7977ed9b005822d0ec45d05dab53f
MD5 09661e2a6d344beb71e309c83badc9e1
SHA1 84397be2eed3267b557284dfdc13187041a51596
SHA512 dcf3b49ed5de0c55d1e568eb45291f91e51b24d4f6622fe5fcf7704bd5763e555408c4c10058ad98be6cc699987faa81c04681565c99b93d9846231b3e78cb45
SSDEEP 49152:Qoa1taC070do9lq24iZIAFA2QR0y5y51C5H:Qoa1taC0vQUeh2Yy51M
TLSH
T1EA952354F7A2C1B6C0811672A5A1C3F7C8793E7D9A858C477BC81A3F2DA0EC16A72747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4148-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4844-6-0x0000000000400000-0x00000000005E6000-memory.dmp