38c5bd734ec317088b9aa08f31eba7e6a3106783cc49ad4d7b1c79596bf87a17

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e77c5e9e1014a14c4599a53ae712edb0_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260804-v93q4aee29
SHA256 38c5bd734ec317088b9aa08f31eba7e6a3106783cc49ad4d7b1c79596bf87a17
MD5 e77c5e9e1014a14c4599a53ae712edb0
SHA1 2ab6db79b7c02f231d61e6968676e8228047776a
SHA512 437a0e63788add3e83e49dcf33fd0789dcc867af57c66cdaa4b91dcc4b89e9bddd8fd3e3f65acacfaff5c9b9aed7c379a30366ae4a40cc4ec18147a96bf7435d
SSDEEP 49152:Joa1tHC070UQEAIB+DRjf7RDA5DDYtvSzQdtp:Joa1tHC0WE8DxRDUDfG
TLSH
T1D1951258FB6481B2C051C8BAE4A2CB17D5B3387A53411DCF2BD59B7B2E23AC47635B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4056	E6CC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4056	E6CC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_e77c5e9e1014a14c4599a53ae712edb0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E6CC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 4056	4876	2026-08-04_e77c5e9e1014a14c4599a53ae712edb0_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e77c5e9e1014a14c4599a53ae712edb0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e77c5e9e1014a14c4599a53ae712edb0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\E6CC.tmp
  "C:\Users\Admin\AppData\Local\Temp\E6CC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_e77c5e9e1014a14c4599a53ae712edb0_amadey_elex_smoke-loader.exe 4DE5D4E2A8961E4D915C2AABF741F9D6D994C3BEED58FC03558F9E1696E1FFA9E89C019A1891D67DEA9B1BD91494CB87BEBABD00DEDA3AB05D71898669B4EAD3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E6CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\E6CC.tmp
Size 2.0MB
SHA256 f0f29e16a98be6dae778f9cd2b8afc7f524654c2d7d318b99c9ba0797ad801a8
MD5 38aace1912651ffcf71773bcebfeb87a
SHA1 258ce4e0d45c62a5834d1dcea0fbd0e4661af793
SHA512 d33c91eba9a10d08724a287b16bfda8f4cb80b94a012b7b169d87ac1e3f3e622eaf64827f96a55835b08ef405151464d7635876ada6f255acd7e34bebd62ecef
SSDEEP 49152:Joa1tHC070UfTXmgTvbovqlwG3RcGpJOylBiHQ+d4Fp:Joa1tHC0VrmsDoCuG3Rc8JOylB44
TLSH
T1A8951209F76881B3D041C5BAEAA2CB67C4733836A3004DCB17A54F7B1E67AC5B635726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4056-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4876-0-0x0000000000400000-0x00000000005E6000-memory.dmp