0512263e5a9f6c07becb04d7eec2a6bef1b76e434f8a66e55f61d97ba93f24f1

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_6eea5affe75e3703b00d279e763c6634_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260803-hsf5jsdm7v
SHA256 0512263e5a9f6c07becb04d7eec2a6bef1b76e434f8a66e55f61d97ba93f24f1
MD5 6eea5affe75e3703b00d279e763c6634
SHA1 1827bf6c48d339f99a1be4f465f4f72db5dbdf74
SHA512 7be4c3a82f480905590036697154893adea1a1df8c407ac596f2e575aa2f4d05f28d524f5b819c14d2fc332ea12f3cd8e9b86d370f2b81464d03377f6406e899
SSDEEP 49152:Qoa1taC070dQj/UZNxBaRrpLGr0NIwtwLMmPD:Qoa1taC0tj/UqpLbczD
TLSH
T11A952221F2D5C2B1C0910674A552C7E6D8A93E7D4700AC877BCD2B7F1AE0EC4AA71B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4676	F548.tmp

Executes dropped EXE 1 IoCs

pid	Process
4676	F548.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_6eea5affe75e3703b00d279e763c6634_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F548.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4676	4696	2026-08-03_6eea5affe75e3703b00d279e763c6634_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6eea5affe75e3703b00d279e763c6634_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6eea5affe75e3703b00d279e763c6634_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\Temp\F548.tmp
  "C:\Users\Admin\AppData\Local\Temp\F548.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_6eea5affe75e3703b00d279e763c6634_amadey_elex_smoke-loader.exe 6E54EACB5CC508FA4506C674F5049AC136E643435DBD748E5065113539837997E4B19ECC6BBD8F8423EF66493070F0E8D9D6B53C1FE9A0B00006857E870EF9CD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F548.tmp

Path C:\Users\Admin\AppData\Local\Temp\F548.tmp
Size 1.9MB
SHA256 af1d70e5a5053d3c0d5e146d002e235c488e1293e12aee463b8abb35cf1c26dd
MD5 bf29b0e595337aae5f8a7c468b15d140
SHA1 b79baba25428a86898904d6e10f72cbdeaa78004
SHA512 933b02c6e2c36012df2ba888993a83c5c8ba538eb9fa294732a213637a978b2ee5c2f7f72ee47d72ef837703dc0b08393352062cbd275edc77fcd7192c54c248
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dTfNhl/wUk6q2lXlyZ4tL4XkGObp0to44T+i5:Qoa1taC070dTVP/wUllXh7bsc+iQhBjU
TLSH
T1C9952355F795C2B2D0861671E262C3F6C8B93E7857018D43BFC81A2F29A4FC06972B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4676-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4696-0-0x0000000000400000-0x00000000005E6000-memory.dmp