f98ba63ce6727d1f0ffcbc41cf360393dce54c4dd4109e9d2c153bed34e318e0

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_a78e2de95c873221d74eaf309143f8b7_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260802-gc971sdg96
SHA256 f98ba63ce6727d1f0ffcbc41cf360393dce54c4dd4109e9d2c153bed34e318e0
MD5 a78e2de95c873221d74eaf309143f8b7
SHA1 a885179c7373452d1c5ff7eea7c5d71f049e4a18
SHA512 1e3e9da4fc7d2b9d16c433a8d5603d0bdaf1c0bee00204703080c5f1c0500d27ed55da25e2a21ea1b9d999b89f92458473f5c1cb1d1dde594b389c00cc01129c
SSDEEP 98304:emhd1UryerRSc+t+YhjUt4mbJV7wQqZUha5jtV:elFAt44iJ2QbaZtV
TLSH
T16D26CF0896FCD92DCC2F52F4A1641185C7F4A564EBD3AF997DA2F1F029823A4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2528	8FA4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2528	8FA4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_a78e2de95c873221d74eaf309143f8b7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8FA4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 2528	4688	2026-08-02_a78e2de95c873221d74eaf309143f8b7_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_a78e2de95c873221d74eaf309143f8b7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a78e2de95c873221d74eaf309143f8b7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\8FA4.tmp
  "C:\Users\Admin\AppData\Local\Temp\8FA4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_a78e2de95c873221d74eaf309143f8b7_amadey_elex_smoke-loader.exe CC94679A4917D0EA09BC703CD17604AC405E24D5E05D432357D32744937368B9CB4D91661F5FA94C983A66C7509856C0C9D45DE19F061F236CAC2DC582B89A40
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8FA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\8FA4.tmp
Size 4.3MB
SHA256 fe0638bee2970b66aa4641eb80f93dfb422519754475d7dce0074028e5c829d1
MD5 af8085a493b1ea5134082509801ffe3e
SHA1 cb7ac6e35816a24eeb466c99dda24f1053cf9e57
SHA512 23613d87cf79db1c4f9b1f2f2d4c858d3525538d82483ac75abb2b86371a1a3586499929e315a5215f2239e185fe5d7d5d5d6556756b05d5dba4c7d3347c100d
SSDEEP 98304:emhd1UryeSm9UcxAV1fd9JV7wQqZUha5jtV:elym4rN2QbaZtV
TLSH
T1D126CF0896FCD92DD82F52F4A1641185C7F4A564EBD3AF997DA2F1F039823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2528-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4688-0-0x0000000000400000-0x0000000000849000-memory.dmp