414be8a802eee8256c292ca7184d8293f59c6dfd1dc28bd14ed4a6469fa65b19

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_5e39bdea030ba1bc1d99666a1dd4596c_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260802-azhyqa1bpc
SHA256 414be8a802eee8256c292ca7184d8293f59c6dfd1dc28bd14ed4a6469fa65b19
MD5 5e39bdea030ba1bc1d99666a1dd4596c
SHA1 a1d12b0ac6bbab8d67eca96b87e73ec9c62a0296
SHA512 864e23933a71cf4a6752d226d19157c63b12b8895a09875378a522dc2ed2ae1b8057012f8eb4e0d3798eae878519e4156872e4c5de19829113e188910f014ada
SSDEEP 49152:Eoa1taC070UrDvH4RAW2tn6A9srTmdNl3TKoxHqvOJFIp:Eoa1taC0dQWW20hKdNtKn
TLSH
T1B7A50201BB14B0F3C5156BB0A895CAD3A6616CBBBB519DC37D84534F4C97AC89F12F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5028	5172.tmp

Executes dropped EXE 1 IoCs

pid	Process
5028	5172.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_5e39bdea030ba1bc1d99666a1dd4596c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5172.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 5028	2256	2026-08-01_5e39bdea030ba1bc1d99666a1dd4596c_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_5e39bdea030ba1bc1d99666a1dd4596c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_5e39bdea030ba1bc1d99666a1dd4596c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\5172.tmp
  "C:\Users\Admin\AppData\Local\Temp\5172.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_5e39bdea030ba1bc1d99666a1dd4596c_amadey_elex_smoke-loader.exe A3EB3A1A10204011F3DA952E424E05EB82332F3FFBBDB2E0DF4D063A814EFE5AAF84A78F8A069AC1C546F4E3BD1159B3F9481EB0E5A2007A769537734756FB0E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5172.tmp

Path C:\Users\Admin\AppData\Local\Temp\5172.tmp
Size 2.0MB
SHA256 a2e7dd12772d17c013663ca9044d3fad7a10e4345cabd4ea0623b128a9f6bbc8
MD5 0c7d5af41ca57325c8032f11cffb0963
SHA1 7c0614fddb89880df9931e76f227223d73f20f66
SHA512 8e7ec4912e28cdfd272137333a9640dd402cd82b17103e730e2176feb66b9a1e1de9efc0e3a561717e9fd9ea15298629a06c770c7b43c378094fc86e3bdc457d
SSDEEP 49152:Eoa1taC070UTfm7fHF+zf5S5NGqvOJFIp:Eoa1taC0JO7PFMS5X
TLSH
T13DA51201B718B0F3C5551BB0A895C6D3A6226C7BBB41ADC36EC4235E4CE6AC89F53F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download