fb8980f2664c34e5128b3d94073ba75e16185d6f9567dd882958dbde9774e493

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_097e1f3c47006f4d23f88a15a00a79b2_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260803-xne41sec28
SHA256 fb8980f2664c34e5128b3d94073ba75e16185d6f9567dd882958dbde9774e493
MD5 097e1f3c47006f4d23f88a15a00a79b2
SHA1 5161af8624e8523d576f19c74599983d4f137dc3
SHA512 274f43cd9a44a6a69e7d24f98972203dbbcffcd3ec2d07c68e7b7da47bc41daafda8bee9eed8c878c0d2597e4685a8b64b3b156b5d562ad39186c07fae936875
SSDEEP 98304:emhd1UryeVPcvFd9Ig6B/VOrS+VLUjH5oxFbxCVLUjH5oxFbx:el1kvF89zOW+VUjZEdCVUjZEd
TLSH
T15A262340B7A5C362D1C275F9608343DA96383F2D467AD64F2FCE2A2EDC749E27678142
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5960	4CDE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_097e1f3c47006f4d23f88a15a00a79b2_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4CDE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 5960	3412	2026-08-03_097e1f3c47006f4d23f88a15a00a79b2_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_097e1f3c47006f4d23f88a15a00a79b2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_097e1f3c47006f4d23f88a15a00a79b2_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\4CDE.tmp
  "C:\Users\Admin\AppData\Local\Temp\4CDE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_097e1f3c47006f4d23f88a15a00a79b2_amadey_elex_smoke-loader.exe 955EB7DE377249137BB4ADFB9C838C9EC58787A248AD4185037A7F415007A404A203605A67FB4C99867C36C58D371CC64FF2A3952392DB073F46B574C4402147
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4CDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\4CDE.tmp
Size 4.2MB
SHA256 4d86545fb562b8ebfc4fa838677a680f2084666fff97cce4059195847cddf5ba
MD5 aa279095ae84078b7da96645b7bf92ff
SHA1 ddda9b8d7a817e9e2843d1d458f7138578daf2b7
SHA512 3cb8b0f21202439296e170def7f3c0492563091716dcd17c3adc98a1a83c24902855bcfcb4e919ffadfe17eee777fce40f86efb93f5f32c8b84529e1774c0a6f
SSDEEP 98304:emhd1UryeaEVRllVKInVLUjH5oxFbxCVLUjH5oxFbx:elPVRvYSVUjZEdCVUjZEd
TLSH
T132263390BBA5C221D1C275F9609343D6D9343F3D4679958F6FCB2E2EEC684E27278242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3412-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5960-6-0x0000000000400000-0x0000000000849000-memory.dmp