4972db76e1bc1fb823e5424672b55955f3771ce551d98403bca5794c832616b3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_0168021b11fd73918ed87b122b03a297_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-k8pgzazdpf
SHA256 4972db76e1bc1fb823e5424672b55955f3771ce551d98403bca5794c832616b3
MD5 0168021b11fd73918ed87b122b03a297
SHA1 a3b76c4c60d6fff0ad0b7eab8696deca05799f7c
SHA512 5afdda425017bec3b9ed5ebf047cbbddf65577be7fc25c65fbaf650cc34108819cb16d0d6dbcadceb90164e4a7dfdbac22b613f58aa2c119db1a24bd1815e1f1
SSDEEP 49152:Qoa1taC070dyPJJey4NPUXYhSBYeMF4e0sAbW:Qoa1taC0HWJreih0sAbW
TLSH
T1CA952320F791C2B1D0C10671A6A1C7E698663EBC57558C833BC92B3F6DA4FC0AA75B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3736	4F8D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3736	4F8D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_0168021b11fd73918ed87b122b03a297_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4F8D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3736	4964	2026-08-02_0168021b11fd73918ed87b122b03a297_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_0168021b11fd73918ed87b122b03a297_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_0168021b11fd73918ed87b122b03a297_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\4F8D.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F8D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_0168021b11fd73918ed87b122b03a297_amadey_elex_smoke-loader.exe 394A06C16B3CF386DDCF18A493208CFFE49AC2B23547619BE0A418B9311F38C19E97B4BF38FD74FE23FD247867760EB86D838F1302E485C986EEC73873994C25
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4F8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F8D.tmp
Size 1.9MB
SHA256 4263bc2f1e4b56756309ca27f3fc9a24754879bb3080bf6f9344aa38efc9aaae
MD5 06d78859060d324dae9284b2866ff28c
SHA1 9a3d16f24ef159bb30872afb5b440610aee5d08a
SHA512 eca0e5e0214b85bbb04715d19a12413d30c7e649d9e61452c33c47a69e41fdf637aadbaa7ba4b5859092a9642238e577c2f4be97039308c5a706bdf51590422d
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dbRbmTFim4cI26TgYYMVKtwgfPj34ySq/LXnZ:Qoa1taC070dZc/SgMNI4CX
TLSH
T1D6952254F394C2B1C0820934A5A2C7EAD8AD3D7C16468C877BCC1B7F6990FC5AA72B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3736-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4964-0-0x0000000000400000-0x00000000005E6000-memory.dmp