3053ac64b43d326fdaea32415107c80c4e8a7980e1172df1d03b044b118d721a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ae4e50990f25f72b4ebcabcc8b88f235_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260802-vr9rpadk2v
SHA256 3053ac64b43d326fdaea32415107c80c4e8a7980e1172df1d03b044b118d721a
MD5 ae4e50990f25f72b4ebcabcc8b88f235
SHA1 03fe657122b2151e941b5b0ccb03858c28b72683
SHA512 8531f9653b295c72464af854b5a3e739e4343d792669cf0a3cbfadc33d2e751606c26180f3d61bbab208adc3d561eefbcbae8ff4106d6660a69917b5ac6d1879
SSDEEP 98304:emhd1UryeK2bMmKx3diLAmrVLUjH5oxFbxCVLUjH5oxFbx:el7QmKxtiL/rVUjZEdCVUjZEd
TLSH
T156262380B7D4C361D08275F9608383DFC6343F7D563A954B5FCA2A2EEC685E27279292
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3280	6613.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ae4e50990f25f72b4ebcabcc8b88f235_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6613.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3280	4588	2026-08-02_ae4e50990f25f72b4ebcabcc8b88f235_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ae4e50990f25f72b4ebcabcc8b88f235_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ae4e50990f25f72b4ebcabcc8b88f235_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\6613.tmp
  "C:\Users\Admin\AppData\Local\Temp\6613.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_ae4e50990f25f72b4ebcabcc8b88f235_amadey_elex_smoke-loader.exe 87C4FB6E903FC9F4B5393FDAD6C70BF78247E25DEC725E2B672DF4A39CDE1670F5D357468E1F4E2E0008558ADC98F03690E023CA81B837556CF4A4975B2A6493
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6613.tmp

Path C:\Users\Admin\AppData\Local\Temp\6613.tmp
Size 4.2MB
SHA256 212f196b69a227f13c80295ba2bd92783d6c62f306ea6452191486deaff6a2a3
MD5 a7f108fe5109602c01ca9a37c5435312
SHA1 50555e87f7c2a30fa7fe6674d9bf542565acd0fc
SHA512 68f7279c221143a7dd8ac31babee7ae5c6b7a463425703e0c6ec7a8731ff053fdf2ce184d49e7d8ab762645fe2d3378a3d9ac71877c7cf32cac9b226e1634760
SSDEEP 98304:emhd1Urye/D6+sQS8bwn9VLUjH5oxFbxCVLUjH5oxFbx:elb6dU89VUjZEdCVUjZEd
TLSH
T1B2262381B7D5C362D18270F9608343DADA353F7D51769A8B2FCE2A2DEC649E27274242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4588-0-0x0000000000400000-0x0000000000849000-memory.dmp