17e221431662731ff2675584f8fc1ac8c0d83000845986bef1b1bef5c4ab63d1

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_586e75e8694498348b6a1ce034d85788_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-w6ds8sel4x
SHA256 17e221431662731ff2675584f8fc1ac8c0d83000845986bef1b1bef5c4ab63d1
MD5 586e75e8694498348b6a1ce034d85788
SHA1 8cd633863ce6fe254171dcdb1ca515cf7b6a5487
SHA512 b57bbe2113621dbb43da8057b4db6426f989effb00a8a73fff4805dbd1b8f89794080dc9870266ac0637e2b6f0045d4fecbc48e6d718c8fdf992b4c43afa5d41
SSDEEP 49152:boa1taC070U5IKGOqlXtymSzDC9JBDkw220i:boa1taC0rZBI+KfBQwZT
TLSH
T10C952360F781C2B1C0911675B691C7F69CA93EBDA3458C83BBC81B7F2990EC16632B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4636	C176.tmp

Executes dropped EXE 1 IoCs

pid	Process
4636	C176.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_586e75e8694498348b6a1ce034d85788_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C176.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4636	4860	2026-08-02_586e75e8694498348b6a1ce034d85788_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_586e75e8694498348b6a1ce034d85788_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_586e75e8694498348b6a1ce034d85788_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\C176.tmp
  "C:\Users\Admin\AppData\Local\Temp\C176.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_586e75e8694498348b6a1ce034d85788_amadey_elex_smoke-loader.exe 012961C4D518F69A7D9C823BD8F6AC82B6E6C0D270EC87CAF458A05ABE7B2CE5394BB1F36E2B816F191052E94725FAEE590C261514DEAC25F8509B32EFDBD98D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C176.tmp

Path C:\Users\Admin\AppData\Local\Temp\C176.tmp
Size 1.9MB
SHA256 77483c9fe35101186536b660ff8b01e94c2f93a4bfc63f14a13c89eeb3efd137
MD5 3657c39a229cee354dba2df25767023c
SHA1 c81058bf507ec79f8b6180de7a856ece3dc41919
SHA512 c2498a59edb3db8036824562169aac39701324032bf2408230a89d95b1ca1b0efbc622037f72ea33a4f3c53b19b502729892c35bb9d685fba1d95c77ba544238
SSDEEP 49152:boa1taC070UACuLFQHhZAzDUi1/wjhK6:boa1taC0kgZkL/f
TLSH
T166952215F795C2F2D4820632B552C7E6AC6A3E7D46468C837FC91A7F2860EC41B72B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4636-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4860-0-0x0000000000400000-0x00000000005EB000-memory.dmp