bac80dfb0eff462261716a12c36bdb1e850c4c0c2add53d5ea2e9629d956ddcc

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260804-tr5x3ade85
SHA256 bac80dfb0eff462261716a12c36bdb1e850c4c0c2add53d5ea2e9629d956ddcc
MD5 2e58f528c5dc4e3d69879a93faf131a6
SHA1 211cd2270c9ab51b19c4639ccffe33638ebeeb50
SHA512 90f822d011b68ed7991002554b8bcfa60114bb931f574d9f320269487a9db6b4d61a63f17f8b6442cf546c82274ce73ee9a08eaafcdcb92d22084adb43314001
SSDEEP 98304:emhd1Uryeoo/duz+Bfr0+V7wQqZUha5jtSyZIUS:elIoFo+BzB2QbaZtlir
TLSH
T1B956BF05EBE8EF1EC51F03B590B2222657FAD894D783EBD6A951F5B07E82350BE02153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6080	92FF.tmp

Executes dropped EXE 1 IoCs

pid	Process
6080	92FF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92FF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 6080	4304	2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\92FF.tmp
  "C:\Users\Admin\AppData\Local\Temp\92FF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe 309A5CE1454257E089D24791D528C1956DE667C2FB45116528A392D4AE56779392723BDA444712A9666D8E37EDD6D276C5D5132F92932035279CE2EA93DDB9B1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

92FF.tmp

Path C:\Users\Admin\AppData\Local\Temp\92FF.tmp
Size 6.0MB
SHA256 16d32850f4fe6cfd31fec9aef5c27c4c8c0256db07f834e6839212ec876b80fa
MD5 b31ad40e684ddd78fd40a3ed6c3cb299
SHA1 a158a3922cc14d64c9bcbd99eada20e9ab5759b1
SHA512 6557b5bb7d8b511d39b525eb4a1706b45af91046f36009b4d9bf96ceb289ee238e2ab7305773b25a006bfc46dbc4eb290cc2074adf2277c77be1605e49a999b7
SSDEEP 98304:emhd1UryenpEN8DGNgPyS+YV7wQqZUha5jtSyZIUS:elJENhW2QbaZtlir
TLSH
T12D56BF05EBE8EF1EC91F03B590B2222657FAD494E783AFD6A941F5B07E82350BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4304-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6080-6-0x0000000000400000-0x0000000000849000-memory.dmp