6e43a2066264ccdd8657394ad23a7691b10fb165f3b5cf3b619867940e4f1b58

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-jtkpssfd32
SHA256 6e43a2066264ccdd8657394ad23a7691b10fb165f3b5cf3b619867940e4f1b58
MD5 ce8ec76f4bfedb870655bca52dd66ba3
SHA1 6a3633e5d619a40881a406c8dc255cecc7030840
SHA512 6c074a582252a4a09d55d9fde6acda4fa21bd19a47a09c2b34f44adc15b910b91975a667dfe750078ca9ae0e2215efcb854023c8f9de7e551a9ca42034f25228
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dXz9hChnErFsb3KvDQeZpJWX4fSD/GSV9I8bA:Qoa1taC070dzmErFK6/ZiX9ICYq2q0
TLSH
T1EF952341F3D4C2B2C0804671AA62C3E2E8B93E7D56859C47BFC81B3F6960EC45A76B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4512	88BE.tmp

Executes dropped EXE 1 IoCs

pid	Process
4512	88BE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88BE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 4512	3672	2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\88BE.tmp
  "C:\Users\Admin\AppData\Local\Temp\88BE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe 0BB28BC0696D55C7080B43BC1DD1219841EB1284082374ED9465E543CAE159FA9F9B605E6A5C08D4164269250881738180F95772EF507920E58AD58CFAFE4D19
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

88BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\88BE.tmp
Size 1.9MB
SHA256 3c62f281f1441735729e7c1459badd2e54317709b74940a56cec89fa792787ba
MD5 160df2287d58d3f262497cbeb211d06f
SHA1 d6eec0fc207e17068de6165f1b788dd89cc17033
SHA512 3f8d90592af3ae42d76e8acde54288fafb0e24342c1c53535f332a5daf38b378ae4ed48590dc10e7bf92dde01451de53a8ec7ac9c7a32dc473dcccac6aefa4aa
SSDEEP 49152:Qoa1taC070dAqipITunWhvoGcolsQbGJaSaxMZz:Qoa1taC0aeITuWhwGFkaSQ0z
TLSH
T106952261F392C272D0810670A622C7E7C9B57E7D5A449D83BBCD1A3F29A4EC06B7170B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4512-6-0x0000000000400000-0x00000000005E6000-memory.dmp