858fc3dfdbaf886e2b45a2fd116d1506dc13f1d8cac527d288d2f0d2fb2c9568

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260802-xdklraec47
SHA256 858fc3dfdbaf886e2b45a2fd116d1506dc13f1d8cac527d288d2f0d2fb2c9568
MD5 48f7045a676229e1744a78d7f71533da
SHA1 9af5e00b321ad63cd6d6c055c59c4b9ffd3893db
SHA512 5af46912bb4ba91e77ce7ef078d342a452cd569da2fdfc16a5b80ec7a658844a3ef0bd1197befc90c65e222421594a43a7b9390e2fa1d8edac515ccddffc472e
SSDEEP 49152:Joa1tHC070UxL6DmJJPRKyXzOheqsHMJfg1o/HLy6ZzxLkKyGSp:Joa1tHC0rGAJPRjOhtsH0o4uUlLz
TLSH
T16C951259FA5881B6C05184BAD2A29BABC873387953004ECB27D59F6F1E27EC47630763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6136	7D64.tmp

Executes dropped EXE 1 IoCs

pid	Process
6136	7D64.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D64.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 6136	4200	2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\7D64.tmp
  "C:\Users\Admin\AppData\Local\Temp\7D64.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe 244E1802DA267FF2A925EAC854A3FC603AA335DA0E25B453FC9D357008211C92798B035E7315824218FDE5E5F4A467A6EB2D27694C6746FF84D1944FB64CAD7F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7D64.tmp

Path C:\Users\Admin\AppData\Local\Temp\7D64.tmp
Size 2.0MB
SHA256 5d88e306eab5381f9586496071922fd6f43b5fc6f903ae47f45f371c11a5745d
MD5 3cb7f40d6f43249c45b8a7e69f0f4feb
SHA1 fc1ee6ffadde613466e7c143024e44485126692f
SHA512 e78d30160c2bf007abdd9ef13f47cb01327b27cd25a8bdcbf7f392cf17c081bb8dd694d3a605c11bf593e375757c562bd4fe92c1ca822e1d197dd66dc735147a
SSDEEP 49152:Joa1tHC070UJP6Mx1I7a9w8vGnsR2TAGUhp3fp:Joa1tHC0p1M4sANhp3
TLSH
T1B8951218FB6482B2C04299BAE262CB93C5B7387657004DCF57D54F7B2E27AC57631B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4200-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6136-6-0x0000000000400000-0x00000000005E6000-memory.dmp