08f70ea73f6f5448429a8d48246b0312021935633b5ebf93f97359b43593ef97

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260802-wddb1ade43
SHA256 08f70ea73f6f5448429a8d48246b0312021935633b5ebf93f97359b43593ef97
MD5 889432d0820d4ce4197302292e77131e
SHA1 269c418e4519fbea4b71d1ffc52ad1ead73a85bc
SHA512 8d587d692c6d4e8259cbeed3d0a7608af69800471ca4c90ac7b9326eb0b44937f9c27716a91f8669d67870419a84d1ba7ff949200c7259b09d89fbb0d6492ed8
SSDEEP 49152:foa1tqC070Xon3YPkyaDSQGx4eeD5moxsddlz:foa1tqC0yYGhx4eo5HKd
TLSH
T1D2A50101B3E68170F0E21A3495B282519D763D785BF59ACF2EB8D61E1E72EC09D71B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4364	5CEB.tmp

Executes dropped EXE 1 IoCs

pid	Process
4364	5CEB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5CEB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4364	4300	2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\5CEB.tmp
  "C:\Users\Admin\AppData\Local\Temp\5CEB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe B7B76B15577AFD24011BDF50197BF80081EBACACD3F933F3F46D8B01D5E78F4AF897F17B42CC03A18AB5D8489C7656F2032AC54A11C05B139BA26C189B7E7741
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5CEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\5CEB.tmp
Size 2.0MB
SHA256 be0336360338196f8f4226f442dc779af954a6c17a8c34157e943e5d9a84321c
MD5 b49aed66f3fe79225156b051f77c4bcd
SHA1 f93dd175870a672d951fa13d8496870d4df963a0
SHA512 9311590723d96d15c28be0f9f0aee5fe16100d85dc3eba12d3ceb9b3a956aefb1e176cd2509a8542e043d2774835992d863b2b33fee763a2e014e55e98b8f055
SSDEEP 49152:foa1tqC070XfoU1syBFsNY4ufipcnVnI+zdPGlz:foa1tqC0YbiY3fipcnVbzdP
TLSH
T1EEA50201B3E64174F0B35A3199B282519D763D786BF19ACF2EB8D61E2E72AC04D35723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4300-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4364-6-0x0000000000400000-0x00000000005E6000-memory.dmp