e7648303b1ecbb1c11c7fd70195b049a432aea3efeeffd7ef0e68c3ca7dc03e7

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_643d8edc7e35cfe8887a205134647863_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260802-axj31a1blb
SHA256 e7648303b1ecbb1c11c7fd70195b049a432aea3efeeffd7ef0e68c3ca7dc03e7
MD5 643d8edc7e35cfe8887a205134647863
SHA1 cfc7d5fc26e148811544f7730fbec81cf313eaf1
SHA512 9c3ef1f1b5b9f767df19d11d3dd7d5b235954d2432ed40371a1b45226053f10d29db1e15ae148927a4965e7a3613a9cb5f08019cbe738fea6fa7ab7d1b3e227f
SSDEEP 98304:emhd1Urye820rddVDSAV7wQqZUha5jtSyZIUS:elcJQA2QbaZtlir
TLSH
T19C56BF05DBE8EF1EC91F03B590B2222657FAD894D783AFD6A941F5B07E82350BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4612	3CF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4612	3CF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_643d8edc7e35cfe8887a205134647863_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4612	4968	2026-08-01_643d8edc7e35cfe8887a205134647863_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-01_643d8edc7e35cfe8887a205134647863_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_643d8edc7e35cfe8887a205134647863_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\3CF.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_643d8edc7e35cfe8887a205134647863_amadey_elex_smoke-loader.exe 99F0EB51A56982422AB9DE4FFCDE0CA602CC2B1EC5212FF09EF8A956792AE0F74B27F6C2CE5F4A0B308B9B3788C916F0B134D84BF74A2176EABE3FD67533851A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\3CF.tmp
Size 6.0MB
SHA256 07ab433bc989388da965c3fe7683762637f53f5e4a382c367e7eb5ad227079f4
MD5 1820a062ed609e7e61f3a503838d07a8
SHA1 4ebc835e30aadcdbd15c3fb84d19e35825709cbc
SHA512 37341c382a1314339b6674021dbccabb14359972642c9332ddaf66c7e5154c1c7f112b652b5c244ed7e84ac876c541fddc2e746d230113e71b5004be2539ae1a
SSDEEP 98304:emhd1UryeX6wWBy6RVLViHtRC+WV7wQqZUha5jtSyZIUS:elqwCVL0Y12QbaZtlir
TLSH
T17056BF05DBE8EF1EC91F03B590B2222657FAD894E783ABD6A941F5B07E83350BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4612-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4968-0-0x0000000000400000-0x0000000000849000-memory.dmp