d4f33b21b36344c2d0b43a59a6b6129d6efb07c9963ae7c99f0388099bcc72f5

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_05a20fce3ded00e5f297b113a0e9f80d_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-vbzxjsszbs
SHA256 d4f33b21b36344c2d0b43a59a6b6129d6efb07c9963ae7c99f0388099bcc72f5
MD5 05a20fce3ded00e5f297b113a0e9f80d
SHA1 e1b6907af87d22f0eb01f330bdb388f6938c3357
SHA512 f345a25b3aaf2fae72ce2f4cb95bff3d38d9745cf7d3eea948ff6abab121a60da028fa0d11c35fb85d369a47b9f48e7133b2ae244f97b8eb3bdab3b660963766
SSDEEP 49152:Qoa1taC070d4aFppKpe+0DlfE//cQ0agQ/:Qoa1taC04W7mli/cQ0ags
TLSH
T1B7952211FB85C2B2D0850A31A0A2C7E698AD3E7C5B425D437BC81B7F2DA0FC09A76757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2072	863.tmp

Executes dropped EXE 1 IoCs

pid	Process
2072	863.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_05a20fce3ded00e5f297b113a0e9f80d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	863.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 2072	3900	2026-08-04_05a20fce3ded00e5f297b113a0e9f80d_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_05a20fce3ded00e5f297b113a0e9f80d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_05a20fce3ded00e5f297b113a0e9f80d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Local\Temp\863.tmp
  "C:\Users\Admin\AppData\Local\Temp\863.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_05a20fce3ded00e5f297b113a0e9f80d_amadey_elex_smoke-loader.exe 2BC29F9F5DFF709F8A2E957B3F783199A3DBD06D8AEC0032FCF139A6215CCEBA36827566DAEE9F1E088F3D0E3B9C4728054E02A6A693259986C2EEECE2607CCD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

863.tmp

Path C:\Users\Admin\AppData\Local\Temp\863.tmp
Size 1.9MB
SHA256 aa30b0cece018f0961637462fe6034a9b0c1d3f5ba72a4e5bf5d55e10367ad89
MD5 7a03eaf4ae28ec242d7d6bc63cf5979f
SHA1 0ed08fee9941e0a07ca48b2c6e6f7d486d5f6416
SHA512 0125220ce8dbda309f3760c1c1e4f9610d99545df2a29781fbbd64580a524072b427ae3f18ff2f010d48fe1066cf2e11c10d78170d5d9f1d958a6b1529e1b4dd
SSDEEP 49152:Qoa1taC070dWZ8hnXLbBelVVx/DpXGGbaKSv:Qoa1taC0h8h5ox9WsaKSv
TLSH
T1AB952354FBD1C2B2C0910670E692C7A698793E7D93419C877FC91B3F6A60EC06A32767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2072-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3900-0-0x0000000000400000-0x00000000005E6000-memory.dmp