10dbb52a2e431d3c30964dcebeebfb21460f5b65aff2bbd1509cfc7cc25a5eb4

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ec039193cf553638c7f3655789963baf_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-tr9agsce79
SHA256 10dbb52a2e431d3c30964dcebeebfb21460f5b65aff2bbd1509cfc7cc25a5eb4
MD5 ec039193cf553638c7f3655789963baf
SHA1 60e5e34a43b6e3e03a796dcf3f7eda15b56aaf51
SHA512 f57bd709befea885b452bee7c1ae0c14195a9d269d1caf0fedccf81a3969cb54b9c44011d7b64f2696795a4fbbbb3c99d7417a02eb95aa440d3c4b70c7b9c62e
SSDEEP 49152:Qoa1tLC070rHYQRSJoJ4UPtnig7gjXDGb5G25aF:Qoa1tLC00PtnMjXDQs
TLSH
T1D3952350F7D8C2B2D0510B71E192C3E698A53DBD26419C937BC81E2F2DB4EC16A7A787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5472	69CC.tmp

Executes dropped EXE 1 IoCs

pid	Process
5472	69CC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ec039193cf553638c7f3655789963baf_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69CC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5472	4920	2026-08-02_ec039193cf553638c7f3655789963baf_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ec039193cf553638c7f3655789963baf_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ec039193cf553638c7f3655789963baf_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\69CC.tmp
  "C:\Users\Admin\AppData\Local\Temp\69CC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_ec039193cf553638c7f3655789963baf_amadey_elex_smoke-loader.exe 7FEB2D31DFA22EC19D9275D73854D01D4CE3F902A287B33C83621CC93D9AC1830DA3F8EF13C59F4F38A40C5477F2715BFECCD8BEBE5D6C16A5B011A26FC2EBDA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

69CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\69CC.tmp
Size 1.9MB
SHA256 b36aa144cfe24d7575ee8e54455a5e0bbed0153c9bfaeab2a146d2c774e89d63
MD5 369e5708b2edee0bd906649e9228f57f
SHA1 d85ccab73c0917f35c703c546314e1c596615a99
SHA512 67aba97537735d43dfdbfe60cbb82d99eb0bb17c0dd7ab00d4767250f479a77dce2844f275e939a8a8507941f4f2a63a139afd45f8a83f6091f22fad3dfb0752
SSDEEP 49152:Qoa1tLC070r+p3eW7vzbg2hUQvhOt4o3SIsN:Qoa1tLC0nleybguhOtc
TLSH
T1A1952265F781C1B5D8900A76B591C3E29C293EBD4B409C837BC81B6F6DA4FC06A36B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4920-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5472-6-0x0000000000400000-0x00000000005E6000-memory.dmp