a235f6fd0e7d1e6e7dbaec8aa7d7a941d8e1bff4956bde34a5cf84654e54bc41

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-v4fpdaed44
SHA256 a235f6fd0e7d1e6e7dbaec8aa7d7a941d8e1bff4956bde34a5cf84654e54bc41
MD5 f208e28c66d799fae88282d774bf1078
SHA1 7e4a015d21ef7efdbd2a7dbb6202af12106268b9
SHA512 e08123811ba08f4a6703e78c7e6effa52a3a8568535213fae3a795e7b88d36c983d201d66a1c6d511a23bf281a715772a8bc02decbe0d7e16edeee8cad1156ec
SSDEEP 49152:Qoa1taC070d49QdDRrQJ/o6Xomydv2e4u:Qoa1taC0tQdDado6oZd/4u
TLSH
T1C8952210FBE1C2F2C4800A72A1A2C7E69CB97D7956418C83BBD81B7F68D0EC4A675757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2720	5896.tmp

Executes dropped EXE 1 IoCs

pid	Process
2720	5896.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5896.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2720	4760	2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\5896.tmp
  "C:\Users\Admin\AppData\Local\Temp\5896.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe 36ECAE82072B99FB141E4CA58097DBD243F4AA9A5F55774CCB04AA1871659E9163B83787F78EF0659A037B41DED0F35F412A5128FFB5EA9EEB828E4D2D092D8E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5896.tmp

Path C:\Users\Admin\AppData\Local\Temp\5896.tmp
Size 1.9MB
SHA256 21f10efb2863d786e0e9dc003cb2f6cd4964eda90179d8fff1eac2918c091b8a
MD5 59678bac92d8a5b240e1ded68bf15276
SHA1 04f677aa565c8de69c0ae541f37868403dfa22a5
SHA512 93cec5614234acba9f3d294c0c9edbc82980a8fb9c44b84841e718f66a0999ff32ee98475b69ab8bc46ca6af232e19895d1a24b52a94c02718cf747f8b638685
SSDEEP 49152:Qoa1taC070dLQhZWZfTpZ1gZTd/9wn2ifm/3rSy7:Qoa1taC0OcA1g9d/mnm/bh7
TLSH
T124952355F7D0C2B1C0920670E662C3E7A8A93DBC53018D877BCE1B7F2964EC46A71A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2720-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4760-0-0x0000000000400000-0x00000000005E6000-memory.dmp