3b4203b1d6bd10096fe94825961e876468cf962a688244f8c2c884fe801b1bb6

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_000c6685bb3a5ff81e31acbbc115e4d2_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260803-xtpweaed88
SHA256 3b4203b1d6bd10096fe94825961e876468cf962a688244f8c2c884fe801b1bb6
MD5 000c6685bb3a5ff81e31acbbc115e4d2
SHA1 152f9aee544c14692cdd0f4762203c83525d35a1
SHA512 e3a985ed5bfc5a87072fba0b852699948b471a047c57c1a2a77f375df2c7faf4e5fd29027b777edbb59da276f607bd6826dc7e80a1b9d8c3f7856ab1f51595da
SSDEEP 98304:emhd1UryeC9qQpAnexTmmXHyNr0K4V7wQqZUha5jtV:el1Hex6m3yN62QbaZtV
TLSH
T11F26DF0896FCD92DD82F52F4A1641185C7F4A564EBD3AF997DA2F1F039823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1464	ECB8.tmp

Executes dropped EXE 1 IoCs

pid	Process
1464	ECB8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_000c6685bb3a5ff81e31acbbc115e4d2_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ECB8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 1464	5980	2026-08-03_000c6685bb3a5ff81e31acbbc115e4d2_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_000c6685bb3a5ff81e31acbbc115e4d2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_000c6685bb3a5ff81e31acbbc115e4d2_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Temp\ECB8.tmp
  "C:\Users\Admin\AppData\Local\Temp\ECB8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_000c6685bb3a5ff81e31acbbc115e4d2_amadey_elex_smoke-loader.exe 6CDEA2BFF4D5DEC96B12F2F05EF03C69E92272F1E8ADB64B1CAADF77B4007949FAF4B6C88EB3733525E6E63F5183D2A9F3C42657A3FAF32B0975C4E3150E72FB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ECB8.tmp

Path C:\Users\Admin\AppData\Local\Temp\ECB8.tmp
Size 4.2MB
SHA256 26435f23972a0033ef76084130842e661e726dbce0091a6c36cb9d9d2f894d76
MD5 cf1a397449278f91e6ca10a54a6368ed
SHA1 240a26076efc7e045fab1ecb2c75995e1540422c
SHA512 d373a43b22cbb67e1d0e2ea39c006113981a9b8e57b7fcefb8564a01ced5242bfc365796ddc7a1fb936c0546556b5d2e4f13c326a52ec04ee0f1d020ee913cbf
SSDEEP 98304:emhd1UryeUjjeAVmBy/X911p9Q8V7wQqZUha5jtV:elgjeAjjy82QbaZtV
TLSH
T1C026CF089AFCD92DDC1F52F4A1641185C7F0A564EBD3AF997DA2F1F029823A4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1464-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5980-0-0x0000000000400000-0x0000000000849000-memory.dmp