6854043a5a8ff6183e908b23fb977bbec2cd86f7203d21d3ef54449e6c0daff0

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260803-hdctksdk2w
SHA256 6854043a5a8ff6183e908b23fb977bbec2cd86f7203d21d3ef54449e6c0daff0
MD5 c50d8166224ab8416a0a4027b5d9fc27
SHA1 de06d2914fbb6d7ff3b45dc4424ab8aaaa89935e
SHA512 5de4cff3bc702a8e7d7c94a84d1d149a561564aa5c1ba984e4c5e8f3b56f6f0c4551a886becdeae9f5750a764b0f4e21c0a7be95e264c8050134f626b328ea7f
SSDEEP 98304:emhd1UryeZSer+m5FEfaRdVLUjH5oxFbxCVLUjH5oxFbx:el4er+CfdVUjZEdCVUjZEd
TLSH
T100262340B7E4C361D08375FD508343EADA343F2D552AA68B6FCE1A2DEC689E27275742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1764	3270.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3270.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1764	2984	2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\3270.tmp
  "C:\Users\Admin\AppData\Local\Temp\3270.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe 5CB465BEA18E965375AE7A9659967DE1CA72940F1022AE829D696F5F4E6BF3D8A50AADC13BA118A9C78F78D420D1A92B04D1D5D83CFED495778CEF785F02D575
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3270.tmp

Path C:\Users\Admin\AppData\Local\Temp\3270.tmp
Size 4.2MB
SHA256 a818d72886cfbd7714dfefb061ecadb055c2b607318acc0c44003f86f07b6d3e
MD5 7cf7fbad82700e12eba4a0048dee59fe
SHA1 feee2f14536be4b07b0d23a70a26398d78f29a3a
SHA512 3977c147c046b016394f506da5fa287524ba2ed0941041ae7d68595fa4f1737004a58fe61e50c85ff8242cbdf9d33afef01330c90bb073606f14d46e5198932b
SSDEEP 98304:emhd1UryeN5O9WL6z0rjkzgn9VLUjH5oxFbxCVLUjH5oxFbx:eljL6grjkEn9VUjZEdCVUjZEd
TLSH
T13B262340F795C262D1C275F9648343DBD6343F2D51BAAA8B2FCE2D1EDC688E672B4112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1764-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2984-0-0x0000000000400000-0x0000000000849000-memory.dmp