3f33ac1eb086b858e331ef7ff837fd7b984bc0de5d52896f4f0616ba49903fd3

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_3c43a4596f28635c4746aad32119fd22_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260803-h1bvssdg86
SHA256 3f33ac1eb086b858e331ef7ff837fd7b984bc0de5d52896f4f0616ba49903fd3
MD5 3c43a4596f28635c4746aad32119fd22
SHA1 4a959907f71ae22d05e2210ad4695c6dd13b110d
SHA512 e77b9a6af3b391c1e0e06e47a7157e2b511a70dab47c4b1fb5140c811b53f3e88eaee99814b2c5c67e979ed8848374367c7c38d435744528147fb2c9f77b0d5f
SSDEEP 49152:Qoa1tLC070r5qXoSvNd+89ET6Jmi3vKAtoYY:Qoa1tLC0H4SFd+8E+YYiAt
TLSH
T196952254E7A4C2F2D0910630A611C7E6ECA53EBC4A108D837BCC2B7F6964EC55E3AB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5812	FBFF.tmp

Executes dropped EXE 1 IoCs

pid	Process
5812	FBFF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_3c43a4596f28635c4746aad32119fd22_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBFF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 5812	5852	2026-08-03_3c43a4596f28635c4746aad32119fd22_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3c43a4596f28635c4746aad32119fd22_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3c43a4596f28635c4746aad32119fd22_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Local\Temp\FBFF.tmp
  "C:\Users\Admin\AppData\Local\Temp\FBFF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_3c43a4596f28635c4746aad32119fd22_amadey_elex_smoke-loader.exe 930270B69CB0BA8980C46178B6D45DACF53D85AC4D41DCEEC45A4893D157B14BF332AB5626B23B3A3BDCF3B73818C0D21E3AD48CCC8027CB432E5B446FE1EF3C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FBFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\FBFF.tmp
Size 1.9MB
SHA256 70be97c4392393f9dbda4a9520e7ca604228e94afca645aa79b4e8cda26edd7c
MD5 37901883967ca2bfd55421a87ed1c0af
SHA1 526e98f8b4b43984d13d0795825f3f86af03bdd6
SHA512 5f598eb80b2250cc68e2194562129511b206c0d34b41bee5ab1739861a6a94e45ebe7f41b4387b88424ff53c0bc82115ab714d97e3aea54ed33d0c5d18cb6ed0
SSDEEP 49152:Qoa1tLC070rgzIW7wFN8ArDN2GKZDPu7lFDj8YY:Qoa1tLC00KWcDW7HD
TLSH
T1AE952212F790C2F2D0C20A756591C3E68CB97EB857018C936BD91B7F29A4FC4693AB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5812-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5852-0-0x0000000000400000-0x00000000005E6000-memory.dmp