dc541a805bd19815da64f056124228bfaba5ce15f4cd33a2ae65439a7fab0d5e

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260803-v6rvesvalh
SHA256 dc541a805bd19815da64f056124228bfaba5ce15f4cd33a2ae65439a7fab0d5e
MD5 8733a514f7bda6d7e2913559c83ef321
SHA1 044408668e98c414b8473f5f5c1c210fa680fff0
SHA512 827307ded449cc3fc443b6e98625768ab9d3e9b70ccd4466624f9ad72835256bd1d94135318df35b0956289752bc1fcbe7ffe3cee148dc2097d38e3f55e9bc1f
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dB8+4vNKf6jht5c+wmGhvVOKLu2/3dpywYpr1:Qoa1taC070dB8Dveef5c+eV/D/SMSVz
TLSH
T1F3952394FB86C2B2C4860A71A191C3E6D8693E7D4651CE87BFC8077F2964FC05A72B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4360	F817.tmp

Executes dropped EXE 1 IoCs

pid	Process
4360	F817.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F817.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4360	2880	2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\F817.tmp
  "C:\Users\Admin\AppData\Local\Temp\F817.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe DC5E536B3AC5B22CBCF59181C12B042EF9C1A8102B1A75008F7C357F1DB8D0184F64041B152604D688FEF3136350A6D681AB36569CEBD5D70B7F77A76241A538
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F817.tmp

Path C:\Users\Admin\AppData\Local\Temp\F817.tmp
Size 1.9MB
SHA256 12cbbffd69e1b2f9866c9462512d1a7a5ec06b84863ba131367cc1b2432e2f32
MD5 4baa9b8273c986c39253806970141327
SHA1 b822e5e46937b87d94bce09735f028a2c295eedd
SHA512 7c0929fe6b18bdf7e3f87f6d3a50a39529e73fa6faf1b2d3ca9a01a4c39884c66ae399345ecbbb9a9377869dec629220e801af159771533898b5dc6644922182
SSDEEP 49152:Qoa1taC070dwWlfFY2GVMXzDBbUz0PX63JKY:Qoa1taC0zWlFLgMXzpq3JKY
TLSH
T11C952221FB55C2B6C0A10671A261C3E69C657E7D5B028E837FCD173F69A0EC06E35A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2880-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4360-6-0x0000000000400000-0x00000000005E6000-memory.dmp