321648f18d5011734892a279dd4e2699f1997d64592cd2808454dd576e0f86d9

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e9d7c901ec57c677a1a09a0eaad64cce_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-qysdrsfq91
SHA256 321648f18d5011734892a279dd4e2699f1997d64592cd2808454dd576e0f86d9
MD5 e9d7c901ec57c677a1a09a0eaad64cce
SHA1 f25ab12c66a89efcd1737218345cb44f83e33317
SHA512 2e4bcd5fa5856bb16e09764cc81f9f70f38ebf7794458fdc7646e2aa60e897441b24333a6afed8a886a1935ed14549d7fc0e86f49fe606c7eb6cd7198dc82f05
SSDEEP 49152:Qoa1taC070d/85JI1Kwk2XqCuRDcHZtHdaWRIDG1:Qoa1taC0Z56Qwk2oRD89a7DG1
TLSH
T1C7952250F791C3F2D0821574E5A1C3A6A8653E7E57515C83AFCC2F3F28A4ED1AAB2607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4864	E4E8.tmp

Executes dropped EXE 1 IoCs

pid	Process
4864	E4E8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_e9d7c901ec57c677a1a09a0eaad64cce_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E4E8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4864	4584	2026-08-04_e9d7c901ec57c677a1a09a0eaad64cce_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e9d7c901ec57c677a1a09a0eaad64cce_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e9d7c901ec57c677a1a09a0eaad64cce_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\E4E8.tmp
  "C:\Users\Admin\AppData\Local\Temp\E4E8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_e9d7c901ec57c677a1a09a0eaad64cce_amadey_elex_smoke-loader.exe 356E1774CD30A476377BEEC42C143A24905669F14729D450AC4CB71243ECDB07A3418390FAA49E35B89213D45FEEB4CF8BBEE230A8B66214EA73236B6357F0C5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E4E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\E4E8.tmp
Size 1.9MB
SHA256 741761d457262728c3f66fb0794427d76a3dce317d69ec67c1b0862e6b55add4
MD5 86a5dc41412e720b8010ae810036ca14
SHA1 ab1c9824c71f39ec495651e4e1187e8bc6956be2
SHA512 2f46d6ff89a3a54bc84b8200b600a1261644be54206acdbf4e0e8fe1d54e0e7850b837023ce81aa284dc2ea76bf475524b64824431fe430a2d62928b83fdc5ee
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d3GGCd2HGtHjbVRGycSV07eYM2NwwqyOwG0u/:Qoa1taC070d2p2mJvVES2CwcwgPn3
TLSH
T147952351E7A5C2F2C0850570A151C7E29C7A3EBD57819C837BC86F3F2990EC0AA76B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4584-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4864-6-0x0000000000400000-0x00000000005E6000-memory.dmp