734fa53bade123d7b5f003e1cc11dee995e6de499bf76b7c4887ce4d0ba5eee6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_00086999d2480b377b946edcc845e478_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260803-lljtmstelc
SHA256 734fa53bade123d7b5f003e1cc11dee995e6de499bf76b7c4887ce4d0ba5eee6
MD5 00086999d2480b377b946edcc845e478
SHA1 3c81c15096802d3fe66cfc9d74f2b9c1a92334c8
SHA512 ddfca875ea19271fe197a30e63c62ec3e6b29de3ac0cfe564710a959b4fc5bdf36cd5a8fbae1fce286fa99ce5dbc0253953be1d6f407d0ae425f112f7a8614f0
SSDEEP 49152:boa1taC070UlecGPg1f3rypx/o/ILvig8wJEa:boa1taC0ly34yvig8wJEa
TLSH
T120952391F390C1B5D4814AB2A9A1C7E2D8A97D3C5741CDC37FD80B7F29A4EC42632A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4152	45C9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4152	45C9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45C9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_00086999d2480b377b946edcc845e478_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4152	4580	2026-08-03_00086999d2480b377b946edcc845e478_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_00086999d2480b377b946edcc845e478_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_00086999d2480b377b946edcc845e478_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\45C9.tmp
  "C:\Users\Admin\AppData\Local\Temp\45C9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_00086999d2480b377b946edcc845e478_amadey_elex_smoke-loader.exe 710DAE876215CDAA72C2A39EF7A5DECBA6E97AED863BB0E299F8603949B1BEA18AD2455D97942A83FB07A2234D95946BC7FF6209B8DDDACAA8B70DB331054C7C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

45C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\45C9.tmp
Size 1.9MB
SHA256 6608e273ad657214f4ac6a72dcdd66ae19039ef5f2775490673f58c032aa8c3e
MD5 80922f7215e2b9bf87e5a5c60367f4df
SHA1 ca1ff815f1fbd96ee2ccd2551deb7b77e9b0e2d1
SHA512 59a682a07fde409b9e0643c506d10aac3f052dde94b7e54837afad47081c216a4464847187a22fa225e19db18ee7d14e91a5ef8e8a02672c875297b3754833fd
SSDEEP 49152:boa1taC070UkMtcVpZHGngZKEL/TCpaxNiz1L:boa1taC0i9V7H1F+1
TLSH
T171952354F389D2B1C0924AB1B692C3E6A87A3E7C67818C877FC81B7F2954EC06971753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4152-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4580-0-0x0000000000400000-0x00000000005EB000-memory.dmp