82b1f15e85985fd033f4a38739757f52127d8d11f2eb53c19e8cf944b2f978f4

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_78617875d49e5eb814f8244003364bf1_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-kdbydsyelf
SHA256 82b1f15e85985fd033f4a38739757f52127d8d11f2eb53c19e8cf944b2f978f4
MD5 78617875d49e5eb814f8244003364bf1
SHA1 0fc904ed46dcb64d6aa1f1c5e3591f11912de774
SHA512 d691710386a68978cd10e0dbb01bc604a81fda9284006f2ef60fab3727f13124a74c384ed643c5520012e6a5fbb867d7ba639435077bc0c7aab4f040b5bd107e
SSDEEP 49152:Qoa1tLC070rrylRaSfsKuCuIZ2S0ei6aba:Qoa1tLC0flnkKuCuIZPc6
TLSH
T1F7952355E3A4C2B2C0801671E651C7F7E8683EBC57428C837BD81A3F19A4EC52B76B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3416	ECFB.tmp

Executes dropped EXE 1 IoCs

pid	Process
3416	ECFB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ECFB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_78617875d49e5eb814f8244003364bf1_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 3416	3956	2026-08-02_78617875d49e5eb814f8244003364bf1_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_78617875d49e5eb814f8244003364bf1_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_78617875d49e5eb814f8244003364bf1_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\ECFB.tmp
  "C:\Users\Admin\AppData\Local\Temp\ECFB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_78617875d49e5eb814f8244003364bf1_amadey_elex_smoke-loader.exe 43F07D542328A097722E7FA55B1B0084766EAD008B7C4961638C2A818452AC49BA9EBE91CAA09C7F37E1CB56651A73EA46805B79B0DE95F943AA0D52F0A870EA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ECFB.tmp

Path C:\Users\Admin\AppData\Local\Temp\ECFB.tmp
Size 1.9MB
SHA256 24c0aa3befa579cd026fe7b52814616423e2656640648c5324fe3377f9f9f872
MD5 73fd1e6e96d3d21fe14c811647633b26
SHA1 99986aedbceee814c7c399871ce9451562eecc84
SHA512 57efec40194185419ff4e856506b7edf8192b9e6905315e5bec0e1fee93c0dc164e255fd5aabf12a1af761625984a722e032843a2072eaa0dbdcefcc717b8bf7
SSDEEP 49152:Qoa1tLC070rETh6SOID1aT0Sp+x5aJWEm4js18+k2:Qoa1tLC0JQzI20i+72WETs18+
TLSH
T1C7952221F795C2F1D0820A75B2A1C3A79CB53D7C97569C83BBCD2B7F28A4AC01A25747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3416-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3956-0-0x0000000000400000-0x00000000005E6000-memory.dmp