cbba1d0e7b160880e11077eb33081288fa9d523081cf292365aa2e37ac648637

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_095d4788bd2cdc1b4603d3c491a9af1d_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260802-yfmpka1bmb
SHA256 cbba1d0e7b160880e11077eb33081288fa9d523081cf292365aa2e37ac648637
MD5 095d4788bd2cdc1b4603d3c491a9af1d
SHA1 e1ba542b74e98e6ba9eb104bc6e3b34d4e600d64
SHA512 ab0baef291c97af54150a0ff25a26e24f6a7e9d53d2ce2cdc25049b2c3887b68b8d22ed5713b6deba48266e821d509a07c70c95d2cf40fe98e964ed49b239404
SSDEEP 49152:Fvm22OdWOXqrbIyUJG6k0g9ea/2qKR7ZHdobzaABUwLVT5kUvgJSgHT6ojkxFbxx:5mSWOiIyU00gNO5tHWfVLUjH5oxFbxx
TLSH
T151E52340BBC4C2B2E1C135F9718347DB98783E7D4626D9473FCA1B2E9C689E1BA75242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1952	8E0D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_095d4788bd2cdc1b4603d3c491a9af1d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8E0D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1952	3984	2026-08-02_095d4788bd2cdc1b4603d3c491a9af1d_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_095d4788bd2cdc1b4603d3c491a9af1d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_095d4788bd2cdc1b4603d3c491a9af1d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Users\Admin\AppData\Local\Temp\8E0D.tmp
  "C:\Users\Admin\AppData\Local\Temp\8E0D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_095d4788bd2cdc1b4603d3c491a9af1d_amadey_elex_smoke-loader.exe F1EA6E0603FC23D6F3380572CE7729DD8BFEA5216D790FE1218DABE258F4DDD801B7E898A3BE362BB9AE1733A748DBA10B2BF5699AFE0C1F9EC598A430975F69
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8E0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\8E0D.tmp
Size 3.1MB
SHA256 2fd3fa1d93d78bca2679448ca91406a4b12472f1f4901a17bcef3ffae593730d
MD5 922e4a424191f51802347e873498690d
SHA1 dd48ec3bff0e9d1c8dac744dc78e802bd01056fb
SHA512 1a7d539015c3f5f6ef3dc33586c71404b9554f35b0bdbc82606794112ab88475a398160bdf7341559045193f0e94b398ec8552ef4104cebeebefef711bc44c7c
SSDEEP 98304:5mSWOiIyUcpCs1o8Y1uftYVLUjH5oxFbxx:5X2pXmD1etYVUjZEdx
TLSH
T102E52341B784C272D18679F9608343D7D8383F6D5526DE872FC92A2EEC948F1B27A246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-6-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/3984-0-0x0000000000400000-0x000000000071F000-memory.dmp