35044d5f4bd7cc17bfa22f39f2e0dac3b9c6358c8e2499ad39cbff3e7d612063

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_e9db707f0c539d897f8fc4fe89d49b64_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260803-kpgb9aeh66
SHA256 35044d5f4bd7cc17bfa22f39f2e0dac3b9c6358c8e2499ad39cbff3e7d612063
MD5 e9db707f0c539d897f8fc4fe89d49b64
SHA1 08ef6c7ac6a2833bed713705783f192480161beb
SHA512 14cf697c6556da92567065efef7686e4e99827a6e961f35bff4229a36464f85486feffc7a386761d2f9a9f8dbbc26712d6913c0ee435b95cbcb04d8e5a342471
SSDEEP 49152:boa1taC070Ul7a6P4uMpEoeYE+Kqc0zb4xNqq:boa1taC0r7a6P4zp4YE+Vb4Xqq
TLSH
T131952350F798C2F2C4810571E992C7F7E8757E7C86558D837BC81B2F28A0EC4AA75A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4992	164D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4992	164D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_e9db707f0c539d897f8fc4fe89d49b64_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	164D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 4992	3316	2026-08-03_e9db707f0c539d897f8fc4fe89d49b64_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_e9db707f0c539d897f8fc4fe89d49b64_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_e9db707f0c539d897f8fc4fe89d49b64_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\164D.tmp
  "C:\Users\Admin\AppData\Local\Temp\164D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_e9db707f0c539d897f8fc4fe89d49b64_amadey_elex_smoke-loader.exe B2F85975CE1CCDFC498A1F0CFF4D96CAC717E6A466D2861F6C7AAC57221A07A9B59A43510994495045BA7D2F882E611142AB12F1AC65C56215685382EA0F43DC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

164D.tmp

Path C:\Users\Admin\AppData\Local\Temp\164D.tmp
Size 1.9MB
SHA256 376de693c437360dc33cb6290c4c7a789b71b5f49e8e1a8415338669a63cc55b
MD5 2d116cc6756dd901920a1d2d321095ab
SHA1 90d589b055a55dc4e5602a4ea3d92681b40152ec
SHA512 2dddad2a4ffa419f851ce08b48b1bc9b85a88d090e21a4e8e9c03d72d1944f0f7bbc7c850d5e7ca2aaa709f87fe2cb21c4bf53375cb2e5dc9e295cccd41bb74b
SSDEEP 49152:boa1taC070U5zWxKVvAl/WIcE+O3EuZnvDjeMQq:boa1taC079ZAtWIcC7ZvnMq
TLSH
T131952360FB99D2B1C0820571E591C7E698643FBC5746ACC77FCC1B6E29A0EC09A32797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3316-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4992-6-0x0000000000400000-0x00000000005EB000-memory.dmp