a9414497907a9ad9a647c6cda6e4563d1eef77e2bd9f5d42467414353f86c480

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_9ef67e1f29ba1ab621db106889537947_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-gtknpaea99
SHA256 a9414497907a9ad9a647c6cda6e4563d1eef77e2bd9f5d42467414353f86c480
MD5 9ef67e1f29ba1ab621db106889537947
SHA1 13c6fbc9084a95799b411f54853c4b57850575e0
SHA512 a2c6135d0f56d7a429237fc28a60c314c60e73647edfba45ca308eeced0744906c8bb901c50d14799130bc8078ec4f31df490028c6e9249c232090f600e61500
SSDEEP 49152:Qoa1taC070dsS92d2Lz7ZEK5sFftyzW2DxpA1I+aFQSuTI1eVWqI:Qoa1taC0bQkK5sFFyz3tpAJ9meoqI
TLSH
T18B952291F790C1B2C48205B1A542C7B6DC6A3E7DA7858C837FC92B7F2954EC09A71B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
408	AC63.tmp

Executes dropped EXE 1 IoCs

pid	Process
408	AC63.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_9ef67e1f29ba1ab621db106889537947_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AC63.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 408	4708	2026-08-04_9ef67e1f29ba1ab621db106889537947_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-04_9ef67e1f29ba1ab621db106889537947_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9ef67e1f29ba1ab621db106889537947_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Users\Admin\AppData\Local\Temp\AC63.tmp
  "C:\Users\Admin\AppData\Local\Temp\AC63.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_9ef67e1f29ba1ab621db106889537947_amadey_elex_smoke-loader.exe ED15AB30B92F8BE52FF39A56A5A9EE74E5501A49367358D76A08A35C73DE4F1331018C3D3A3A335E2F03D9F19EAC92F24848B77F59551220234D170933D6143E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AC63.tmp

Path C:\Users\Admin\AppData\Local\Temp\AC63.tmp
Size 1.9MB
SHA256 64b0223e48450ca7f5293af292556207ec28fb34a9035b5c1ee2c8d6b6d79ec9
MD5 4cf0d9b12b60f4e2a7bcb128312a5782
SHA1 fd8b08074122bd9ab678421c1a552a1c0b64cc72
SHA512 b5facaba8a71b41e4287ba5003f815b3d98c23bd91b1e112969f5c677cee7db5031485d940419c84c1507345acfe57623554f9faa9b2c784d4d8c438ac0c0497
SSDEEP 49152:Qoa1taC070dWZHykfC1LC5MBax6KHinVSYY:Qoa1taC0XVfC1LC52ax6KgU
TLSH
T12E952310F695C2B1D0910731A651C7E288AE3EBD5A525C87BFC81B3F29A4FC0BB71A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4708-0-0x0000000000400000-0x00000000005E6000-memory.dmp