62bfb6ce29594e9a9312378366e1f55805f5d6f0e7c87592c9397804262f97f9

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_30e523a648bc55a9ca77b450c337d4b7_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-xsw84azdrd
SHA256 62bfb6ce29594e9a9312378366e1f55805f5d6f0e7c87592c9397804262f97f9
MD5 30e523a648bc55a9ca77b450c337d4b7
SHA1 7ca91f16eace92beb4119a8588d0237e57843ebb
SHA512 cfb0697e43518528e39f96fa5373e05a35e43262914d49c9fb9a5431f93f1f25b99a545361b5ceec167b5f7a5525a73a50df7a6e944bbf551c595fb77399df09
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dy5x4Yjje2XNYgt9pxeud4mNM/xF2OAozehm9:Qoa1taC070dynXNY+dBSmBdwkzxmN
TLSH
T111952210F791C2B2C4924671A9A2C3E2E86A7E7856459D83BFCC0F3F2C50EC45A76767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5248	35AC.tmp

Executes dropped EXE 1 IoCs

pid	Process
5248	35AC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_30e523a648bc55a9ca77b450c337d4b7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35AC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 5248	4736	2026-08-02_30e523a648bc55a9ca77b450c337d4b7_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_30e523a648bc55a9ca77b450c337d4b7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_30e523a648bc55a9ca77b450c337d4b7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\35AC.tmp
  "C:\Users\Admin\AppData\Local\Temp\35AC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_30e523a648bc55a9ca77b450c337d4b7_amadey_elex_smoke-loader.exe 955869C36AC5FFF2B6732EC504BCDE65E678673C9C1D6805B15B02762EE2D270AAFC438B8E563B36106BC3093DE948BDF736E8E29F308EC1B31A4C6E0482C6D7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35AC.tmp

Path C:\Users\Admin\AppData\Local\Temp\35AC.tmp
Size 1.9MB
SHA256 551d7a91d8e595a4848befb6f2ab86f19aa791db4f9cc2c46bee8fef737531ae
MD5 a7d69f2ae1f794abb5f0fa8a838ad28f
SHA1 81dfffdb04237a1ae5a99103208389658bff14b9
SHA512 df72d4250545656504b996000147db0bd34a099f63b9c4c4090b5b2a6b4d2228d3162be5439a6d38dbe38f3e76517e8c2648318f6a52f062c872ccb553aa5b4e
SSDEEP 49152:Qoa1taC070dg3r1gfeH0o5STkTNsuQo3RtXM+E2xVEN:Qoa1taC0JrCiSATNB3HMd2xVEN
TLSH
T1CB952300F795C2B2C4810971F192C3A69D783D3C97468D837BD95B6F2EA0EC1AA71B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4736-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5248-6-0x0000000000400000-0x00000000005E6000-memory.dmp