83620eb95302fcd9a7e75d240cfd550a67669774671f295a02cb1066fcc91fd3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5bf6a21af3d5f2059790e98f2a9b36cb_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260803-k7ss1asgrd
SHA256 83620eb95302fcd9a7e75d240cfd550a67669774671f295a02cb1066fcc91fd3
MD5 5bf6a21af3d5f2059790e98f2a9b36cb
SHA1 7be123db9dbebdb81f213f67bdc44329f1922cfc
SHA512 a242eaba047721402e6cdd22db898db037d9c46159a33699ff126053081b325f440b51e2ff6181efcddc324453465ec7cc9bf83c7146b9992f498e8febadd1ff
SSDEEP 98304:emhd1UryeMYmRiqVVK927FXRV7wQqZUha5jtSyZIUS:elhOXK92P2QbaZtlir
TLSH
T16C56BF05DBE8EF1EC91F03B590B2222657FAD894E783AFD6A951F5B07E82310BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6072	1449.tmp

Executes dropped EXE 1 IoCs

pid	Process
6072	1449.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5bf6a21af3d5f2059790e98f2a9b36cb_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1449.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 6072	2508	2026-08-03_5bf6a21af3d5f2059790e98f2a9b36cb_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5bf6a21af3d5f2059790e98f2a9b36cb_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5bf6a21af3d5f2059790e98f2a9b36cb_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\1449.tmp
  "C:\Users\Admin\AppData\Local\Temp\1449.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_5bf6a21af3d5f2059790e98f2a9b36cb_amadey_elex_smoke-loader.exe 1DB10ACA541EED34A9BD53CFA695C2ED23E88758E80AE82E37B61536EB268D53B50959B706277B959FFE85F2BC3FAABBE3F23EC7A0712E3AE05933F926752FB9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1449.tmp

Path C:\Users\Admin\AppData\Local\Temp\1449.tmp
Size 6.0MB
SHA256 7d4c55ee43d7f8f452b79b6ae69781aa6abc97e7b1b1f39cfbfc0f80740e6443
MD5 ab809614b5d179a57eb58f2298e74b53
SHA1 9896e551fa5a4aa898e4296aab97fc465a110c7e
SHA512 8ceaacae2c9221b45064da82a31f09f1e76cb537a72e160f5cddec64c424729896c371a4feea9ab759b50adac5e83a866192b719e204f1ed0f977288232da70b
SSDEEP 98304:emhd1UryeXlznVwC0V7wQqZUha5jtSyZIUS:el3lznVwb2QbaZtlir
TLSH
T10256BF05DBE8EF1FC91F03B590B2222657FAD494E783ABD6A951F5B07E82310BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2508-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6072-6-0x0000000000400000-0x0000000000849000-memory.dmp