3becd2c0bea8da1020e3ba4bfe0dadc94ddf3466c1e07ee6fd2b9a92464851e3

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f3785d6566fb6464e1dbbf84290fc759_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-qrxd5sbf39
SHA256 3becd2c0bea8da1020e3ba4bfe0dadc94ddf3466c1e07ee6fd2b9a92464851e3
MD5 f3785d6566fb6464e1dbbf84290fc759
SHA1 ce3b188124676e34a3840c56f76eabab5d7bb61b
SHA512 04cec881776b301249c4ba4d89216711dcf3bf321b4371193061087ba9c49b62ebfb02ea836a80d507ac3a13cea6e345ea47da3685303309b34ec8702d2e7537
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d0eynSP5mkLulIEtP9XlbGsMDmi5iQMrBtC5E:Qoa1taC070dgnRkLG6iQM7CUh8e8siI
TLSH
T187952250F784C2F2C0800571A5A2C7E6AC692EBC56468D837FCC1B7F29B5EC05A76B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2032	C9B4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2032	C9B4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f3785d6566fb6464e1dbbf84290fc759_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C9B4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2032	4616	2026-08-04_f3785d6566fb6464e1dbbf84290fc759_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f3785d6566fb6464e1dbbf84290fc759_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f3785d6566fb6464e1dbbf84290fc759_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Users\Admin\AppData\Local\Temp\C9B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\C9B4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_f3785d6566fb6464e1dbbf84290fc759_amadey_elex_smoke-loader.exe A93519E54BC5798C38B9CD2F9386E532CBAF52C8F5F4C9D70056257FF227548055E4917D7B93D561BAD750D784EAA3DFA4C973A0C35D47A6C6FAA40B97B49977
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C9B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\C9B4.tmp
Size 1.9MB
SHA256 369a1663f080efff69954224c0c0d266f84abfe0a1206a10449401f9d6e22b7a
MD5 6e6ec74706b876652d82a8d6cf606650
SHA1 f835d926910747d050c6a69290eb77a35b9c75ff
SHA512 5514cd185b68c34bf15a4fc88f3c57f119c077f4712c976723de02da7526a560c660d1e6a01247aecc94ae3090515d6d82b760d173334f0866dbc02c371f7253
SSDEEP 49152:Qoa1taC070dTS/DAElCDa34IbyO/YAWCW4+ZB41SsLH4:Qoa1taC0z/DAcCDa344vgAWCi4BM
TLSH
T120952294F794C2B2C0800A70E691C3E6DC366D7E93419D87BFD91A3F2A94EC05B7265B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2032-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4616-0-0x0000000000400000-0x00000000005E6000-memory.dmp