2df6d96e72ad9fe745822aa21704b9cdf73a6186c3ca4852e4490e220042cbda

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_768714943ed28353558aeaaf007c6459_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260803-hqs2bsdm41
SHA256 2df6d96e72ad9fe745822aa21704b9cdf73a6186c3ca4852e4490e220042cbda
MD5 768714943ed28353558aeaaf007c6459
SHA1 a11d781a38c2035f845a3e1a8a8b2b88baa28d3a
SHA512 b000bd3da20e19d3f2f41212e265eedc5f0f406f218dc58f939d4c94c05759c0360cf177fb1a263001044085a1cb44862fe0dbddbd071b011e01825fa8c782d4
SSDEEP 24576:P2oo60HPdt+1CRiY2eOBvcj3u10UQV286FKld0GEl01BweNxawtBKhFaHuhx5Tgw:eoa1taC070UUa+d0GElheenZTg70O
TLSH
T1E9952311F795C2B6C0811A71A551C3E6E87A7E7D4782CCC3BFC81B2F69A4EC06A31A57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4788	842A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4788	842A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_768714943ed28353558aeaaf007c6459_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	842A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4788	2776	2026-08-03_768714943ed28353558aeaaf007c6459_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_768714943ed28353558aeaaf007c6459_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_768714943ed28353558aeaaf007c6459_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\842A.tmp
  "C:\Users\Admin\AppData\Local\Temp\842A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_768714943ed28353558aeaaf007c6459_amadey_elex_smoke-loader.exe C1BC02D6B04BF78354D16CFF405A72CCF9AE9FE81E14F0FAEDDE00A94CBFC9988A95A44A7EBFB91A812435939A33FBCD359583001541BA87B39C0EEA9BBBB92E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

842A.tmp

Path C:\Users\Admin\AppData\Local\Temp\842A.tmp
Size 1.9MB
SHA256 42e3e07eea5e15bf7f25011cb24d7eb10cb4e0e18df2f5cc390f9bdce39e60dc
MD5 b98568e1b94b3e4b3c4b4b3ced13e9b9
SHA1 adf644bb3dd742d02b4572162059e1977025a5f1
SHA512 1aab8d60e9e517017dd9251cb6ed5e07e6f07f4d3135d322b0318c5a91e8c92e8a4e38cb86a7f1b990043b3118167d681dac50882f989673459849554a130d3f
SSDEEP 49152:eoa1taC070UM8+GF86uAJP9VqHgslxh0It:eoa1taC0ydk86XJP9VqdxBt
TLSH
T1C3952251F7C5C2B2D0944A72A651C3E29CBA7E7E47419D833FD80A7F28A0EC09A75B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4788-6-0x0000000000400000-0x00000000005EB000-memory.dmp