d316b601592f27bece4e59d551b82cec87cd8fc979123b30b9b8d79e9125cb09

Analysis

max time kernel
148s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_d1a2d0f902e3f6f9a0aaf543fc1d0672_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-t8sdasxaqa
SHA256 d316b601592f27bece4e59d551b82cec87cd8fc979123b30b9b8d79e9125cb09
MD5 d1a2d0f902e3f6f9a0aaf543fc1d0672
SHA1 3ce8d90dee08b14189054a35986688acdbac092e
SHA512 8462f20eec853c3aa78ede44a178d4a2cfc32ce93db90c9178d136a2fa68eb959f407c53795ddb217c0b01470dbe2f0a2b55ddff3f251f8706d47ef5dba2485e
SSDEEP 49152:boa1taC070UEjKeZImalGB9b08lg6Ka0PlJQotMnCVi4:boa1taC0KjFTDb9GJQot7
TLSH
T1AC952310E7A5C2F2C0820675E552C7FA9C693D7C66018D877BC91F7F28A4EC0A671B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4212	18CE.tmp

Executes dropped EXE 1 IoCs

pid	Process
4212	18CE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_d1a2d0f902e3f6f9a0aaf543fc1d0672_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18CE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 4212	4544	2026-08-02_d1a2d0f902e3f6f9a0aaf543fc1d0672_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_d1a2d0f902e3f6f9a0aaf543fc1d0672_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d1a2d0f902e3f6f9a0aaf543fc1d0672_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Users\Admin\AppData\Local\Temp\18CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\18CE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_d1a2d0f902e3f6f9a0aaf543fc1d0672_amadey_elex_smoke-loader.exe 8F1CA32D601EBB464F2C11884FC434F5E9C84785484DFF72FCF884DA0FCA73701EAB7D0391370EB2D23691901805248ADFE19E3A350F2F9C2667FA65A6BB74B0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\18CE.tmp
Size 1.9MB
SHA256 75c12f128d20c0c579843976255d6988ceaf4b78d9b76f02524c50a36ed10c50
MD5 81072e265fce8d7bc988730395fd80b0
SHA1 10be8634466f8c94812e213f88a47817510c35c3
SHA512 ba3fe34b2cc29145d5816af3e30358d49739e5a98ed703015784bfaf14dc0007e6bbf8ed0edc0a44887b047c1bd4156c4670737509632b18cc1612ab35b6b28e
SSDEEP 49152:boa1taC070UVg5eh12StLZAH23E9ePVQFQ4YndaC9Ht9d:boa1taC0Dg01DtLZAHWE8dQi4md7H3d
TLSH
T1F8952261F3C2C2B2D0854A71A492C3A7D8B83D7C9A429D437BCD1B6F5D60EC06A76B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4212-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4544-0-0x0000000000400000-0x00000000005EB000-memory.dmp