fd8b4ad0c4ce1d0be57f1cc508d49c89e744f9e220aae9e047ba9267fde073ec

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e433fabbc71a5c77602bb1a9973f20c9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-txmcxacn5w
SHA256 fd8b4ad0c4ce1d0be57f1cc508d49c89e744f9e220aae9e047ba9267fde073ec
MD5 e433fabbc71a5c77602bb1a9973f20c9
SHA1 7f52512549afb5c3edf0ca77d8bed48fa860b8c1
SHA512 efd72da0efa3425519514e093b08cad9d6ae7432e870a79ef4ffff020438af862b562ae9f8e8816b34d357457dd9669f84c0ec053b4a054802103e181e5a3ce0
SSDEEP 49152:Qoa1taC070duOkNxN3gufNeYtjZUBnb0/yM/:Qoa1taC0okpfNRN20Km
TLSH
T1A3951210F7A5C1F1C4910A36E5A1C3A7AC653E7C17528CC7BBD82A2F2CA4AC49B75727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2264	F112.tmp

Executes dropped EXE 1 IoCs

pid	Process
2264	F112.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e433fabbc71a5c77602bb1a9973f20c9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F112.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5412 wrote to memory of 2264	5412	2026-08-02_e433fabbc71a5c77602bb1a9973f20c9_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e433fabbc71a5c77602bb1a9973f20c9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e433fabbc71a5c77602bb1a9973f20c9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Users\Admin\AppData\Local\Temp\F112.tmp
  "C:\Users\Admin\AppData\Local\Temp\F112.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_e433fabbc71a5c77602bb1a9973f20c9_amadey_elex_smoke-loader.exe C9F298D7AF9132A9AEC887EB913A405D8789A4367299C73C95AA07CAE228B5B8B6F6EFC18A65E61B2F5E49A856E6AB6276CB42FAEAA55F49B49FA4DA3D19E102
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F112.tmp

Path C:\Users\Admin\AppData\Local\Temp\F112.tmp
Size 1.9MB
SHA256 ebb1ffa3f16900748f88344b0aca52aa1940ee7d598e342eef89332dfaefbec6
MD5 ff7257ab0f5e930c2e4774d1e1e5e8eb
SHA1 bbb9499e2f3a9931221ca7cd3cdf89247d4f894e
SHA512 710251f60da85ea40df47f221fe3f3e3f94a9f920f2e0fa4d5707a15774cc6c49c63e0b5855fa65991583c1eefdb6caf9fe576fced3af90356323e1c3066311b
SSDEEP 49152:Qoa1taC070dvkYy/JRzkNU1KfqxV4RrDTzCmuM+/:Qoa1taC0dFlqU1KU4RbG5P
TLSH
T117952251F754C2F2C4950632A6A1C6A2ECA93E7C9705CD87BFC82B6F19A4EC01735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2264-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5412-0-0x0000000000400000-0x00000000005E6000-memory.dmp