3b705da65a851afbc5c4ff0d90c18204bde30f1dffb8a52719d59b832f0a61ef

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_1ea86c856e4eccf4eb13813eed2fd844_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260804-t1v48avdmc
SHA256 3b705da65a851afbc5c4ff0d90c18204bde30f1dffb8a52719d59b832f0a61ef
MD5 1ea86c856e4eccf4eb13813eed2fd844
SHA1 b9bb1982b7ba771dbbfaaa704109e53bd8e82ea8
SHA512 8e18e32112a621f7b17a308b4282519abfc9f0fb28ca58033de2cd16b17748105c149e14161cad3a833521ae3d44f15913f7af2369ce135bc6156eaced8d0fbc
SSDEEP 49152:foa1tqC070XG7nTMYRaeVjAqg8B72WeuI895fM4lz:foa1tqC0rn1RaWA8p2Ju99
TLSH
T152A50100F3E241B5F4B2163599B282519DB63D7817F19A8B2EB4D61F2E76EC08D71B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2860	49E0.tmp

Executes dropped EXE 1 IoCs

pid	Process
2860	49E0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_1ea86c856e4eccf4eb13813eed2fd844_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49E0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2860	4512	2026-08-04_1ea86c856e4eccf4eb13813eed2fd844_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_1ea86c856e4eccf4eb13813eed2fd844_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_1ea86c856e4eccf4eb13813eed2fd844_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\49E0.tmp
  "C:\Users\Admin\AppData\Local\Temp\49E0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_1ea86c856e4eccf4eb13813eed2fd844_amadey_elex_smoke-loader.exe 9611BF80AD7D6F0188F89ADEF0BB423737F2C5265498AF5949A77C62256D2A0A37C5945999DC2E412B693E22741D6174AC40E8EF895D6343843F4109E074320F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

49E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\49E0.tmp
Size 2.0MB
SHA256 dda47a2c95d0db5848b952a2910343e1c86949fa9678d61cb89968b182765022
MD5 ebda6c7cd51983daa1dcdcebe4beab6f
SHA1 9953b00dd747a280248011e2e0b884a73f9f9757
SHA512 873d35fb822cacc5873e1767603abc09c02f4b78fedaf65d002f22e7c589129265a102019c1df28f08fb4ef9313f21af6bd59656b8b5ef7cb5ff85f814e7a151
SSDEEP 49152:foa1tqC070XX+c/VY1lHxFaD+au8fQs1Hrlz:foa1tqC0K+gVY1pqDFQSH
TLSH
T117A50200A3E24074E4F34A3099B282519D773D7857F5DACB2EB8DA1E2E71AC15D76B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2860-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4512-0-0x0000000000400000-0x00000000005E6000-memory.dmp