1d5ee98f177494c7e04b8a8c9c6b442d3649c9b524c0cfbdcc90a2738122c64e

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_9ecd8c89613ca495303793471b41abee_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-afw18sag39
SHA256 1d5ee98f177494c7e04b8a8c9c6b442d3649c9b524c0cfbdcc90a2738122c64e
MD5 9ecd8c89613ca495303793471b41abee
SHA1 c592fbf2cb6767175c411c2bd1a095ddeacefe15
SHA512 520df1c86ab75294eae29086352b9a0cf51ce1689c5ec118d8b027db52c6bea543a09f63f7c3052caf11fc3a9e3d5e2b5243ee6857bfef5f36a5fc10e0e8529a
SSDEEP 49152:Qoa1taC070dkXAySlojG+L4h0gZqkzgEi/3:Qoa1taC07S2jG+L+or13
TLSH
T1D8952250F795C2B2C0811A32E5A2C7E29C753E7D46469C837BC81A3F6EA0EC06B72757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3192	F22B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3192	F22B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_9ecd8c89613ca495303793471b41abee_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F22B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3192	2820	2026-08-01_9ecd8c89613ca495303793471b41abee_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_9ecd8c89613ca495303793471b41abee_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_9ecd8c89613ca495303793471b41abee_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\F22B.tmp
  "C:\Users\Admin\AppData\Local\Temp\F22B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_9ecd8c89613ca495303793471b41abee_amadey_elex_smoke-loader.exe A1DF7051E77522AB579576605F6674380E6999F1F7EDD427E98AB131F72F1A99B21FDA127F152F9111D0B46BFC192D8CC841E58D3BDE8D3567220D98438250FE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F22B.tmp

Path C:\Users\Admin\AppData\Local\Temp\F22B.tmp
Size 1.9MB
SHA256 34d32cfc8237e664b1ea68a3facf5c52e234111c2f4b6cf6e3d8786386db7b25
MD5 52f2b47df03ecd028870f91622849d75
SHA1 8a07c9a86d2497dc705e8cad88e48d92ac1c2195
SHA512 d3bde4795a7f7b64583f17b4a3f2dcfff9aef2954cb9bf5fbd983fa6e28705153991265019b5d6e0227da809bf0eb5788710045a4b6b88bb15452dd9e16742c5
SSDEEP 49152:Qoa1taC070dFT/ezrzA6a2PaIJgTeoGNfqFrOH:Qoa1taC0ZXzA6KILoGNfJH
TLSH
T166952250F7D5C2F2D4910571B662C3E6887A7DBC46869D837FCC1B2F2A60EC06A6271B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2820-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3192-6-0x0000000000400000-0x00000000005E6000-memory.dmp