5fe494350e0d237682ff0ef483ab507dedd679129cee866939efd384376ec5b3

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ec896bc0000598a962eaa006dd9d99f0_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260803-fbkqas11ev
SHA256 5fe494350e0d237682ff0ef483ab507dedd679129cee866939efd384376ec5b3
MD5 ec896bc0000598a962eaa006dd9d99f0
SHA1 5e88d03ab1f267a19a340ca7f39a43516e70ec0d
SHA512 79a3a2f0282f705b0d1b76ea8b4d998e0c4cee64a35fc0b817cd7abd76e1a51eef6c649b6df9a0ffb025a555a0fb3257b9eab7efc609476f33284480a81d9dbf
SSDEEP 24576:P2oo60HPdt+1CRiY2eOBvcj3u10USzJhLzDdQPNjOvW8t86/0rcpBjLt1zQvf5I5:eoa1taC070U4jL/oGljgqV
TLSH
T105952240FBE4C2B2C0910A71A552C3F798653E3896829C877FD94B3F2D60EC169B6B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4612	1459.tmp

Executes dropped EXE 1 IoCs

pid	Process
4612	1459.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_ec896bc0000598a962eaa006dd9d99f0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1459.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4612	3472	2026-08-03_ec896bc0000598a962eaa006dd9d99f0_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ec896bc0000598a962eaa006dd9d99f0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ec896bc0000598a962eaa006dd9d99f0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\1459.tmp
  "C:\Users\Admin\AppData\Local\Temp\1459.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_ec896bc0000598a962eaa006dd9d99f0_amadey_elex_smoke-loader.exe 12B7838520783183412CCFD564226EE0C43D745D49CE20DE39E8E6BDE12ADC8239B34B8869DBEAF76211EEF3A8A7360C95C1170009EF7B9C94B20DFD8AB0BC07
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1459.tmp

Path C:\Users\Admin\AppData\Local\Temp\1459.tmp
Size 1.9MB
SHA256 e3a6d3ca270e2deeff8c745cce940c36b97fb3d135e95b658bdcd6dfd40b02aa
MD5 b6c1564f578f00c0a9dfb1d7be7b5b10
SHA1 65ba49fc1b9e7b2423403a55d697068ec3896be1
SHA512 573d43c4608203439103a44777518f7b38ebcb9b905c6c94d850fe7aeb2087b74bd00922970583b8d0c6eea42b57dd280edbbfec8e091f267d66c1487332dc24
SSDEEP 49152:eoa1taC070UjEZLbJswSWuHs3L56wIWWPpc:eoa1taC0AmRzM3wwxgp
TLSH
T1AA952350F7D4D2B1D4811970A682C7F3ED6A3DB957419E836FC81A3E2DA0FC06A25B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3472-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4612-6-0x0000000000400000-0x00000000005EB000-memory.dmp