b12092245d1a53191a80b9bd43f22c345ce3daf614dff9269293c6db838e2b79

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_acce603a088bebac9b40710a6ec28089_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-j2wf9sfe56
SHA256 b12092245d1a53191a80b9bd43f22c345ce3daf614dff9269293c6db838e2b79
MD5 acce603a088bebac9b40710a6ec28089
SHA1 e1851db131e346bc9c29d139aed432c6620768da
SHA512 b0933cee8aa100be2e9f0007089b8077d67e3f413d32e1a26a938b34bda3132347e45cfa5f5ca10ba0120f74a853f5bff53b80cf618643948df2063c74f96da9
SSDEEP 49152:Qoa1taC070dxY1T2XOlQXPxYsAg+pit4dJTYGVvZ1Es:Qoa1taC06ITYWpDpFYGVvn
TLSH
T1B7952220F7D0C2B1D0811976B5A1C3A68C7A3DBD57458C877BC91B7F28A4EC06A76B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3328	3A31.tmp

Executes dropped EXE 1 IoCs

pid	Process
3328	3A31.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_acce603a088bebac9b40710a6ec28089_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3A31.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 3328	5552	2026-08-02_acce603a088bebac9b40710a6ec28089_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_acce603a088bebac9b40710a6ec28089_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_acce603a088bebac9b40710a6ec28089_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Users\Admin\AppData\Local\Temp\3A31.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A31.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_acce603a088bebac9b40710a6ec28089_amadey_elex_smoke-loader.exe DA8694A3109672098DA05553205E8020A8253ACD105DE8F26B11D8921E3A4FC281D9B499EC44A71378D843114DD9B555727A42B5CD99630D12E5FA1F6F83A690
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3A31.tmp

Path C:\Users\Admin\AppData\Local\Temp\3A31.tmp
Size 1.9MB
SHA256 01e936a4ca135e7c13d5d0f21ac7619e15e72f964845dd137722c1e08b3fc148
MD5 47c92d9d154ba32b3e6d2b30c0ee0f8f
SHA1 74c9cc118c6a0fea9ad3d80ed7e583cd08ba87a2
SHA512 82cf4a726bba342f950290aff2662d2e93febc06f82179f4927500deddc1b9b28a248eac59ce44598ad3507a776c9efbd4ea8308f54b52c1c86074358823bda6
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d09FIE/xFgrv4g3IOq6mRi1vPFnE6bHQlWTD1:Qoa1taC070d0QwOI+B1NF0lhpogyV
TLSH
T120952320F791C2B1C4C50672A651C7FBE8653EBC56818D83BBC81B3F5A60ED01A76B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3328-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5552-0-0x0000000000400000-0x00000000005E6000-memory.dmp