72c34ee5c2d7b7b53907b6dce70f78a0424071aa456353a660bb4c690c4ac7cd

Analysis

max time kernel
149s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260804-vz8vcsec87
SHA256 72c34ee5c2d7b7b53907b6dce70f78a0424071aa456353a660bb4c690c4ac7cd
MD5 f91b2028dfe725e09dc1c9327fcd2359
SHA1 688120f7f25cc7eb060528ae2b5d5c7f40c99dd9
SHA512 dc6c3de594a0c27ca90d36569a8de8cc75a60992abc05454722a26d924a368664d9fe982d3d19109b2ab20ea0c6af9413fff3545789e35546fda9cae0595814b
SSDEEP 98304:emhd1UryePrvKKTin+8Vy9OV7wQqZUha5jtSyZIUS:eljKFHVy9O2QbaZtlir
TLSH
T1C056BF05EBE8EF1EC91F03B590B2221657FAD894DB83AFD6A951F5B07E82310BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2268	817B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2268	817B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	817B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 2268	616	2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616
- C:\Users\Admin\AppData\Local\Temp\817B.tmp
  "C:\Users\Admin\AppData\Local\Temp\817B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe 85843D9A8531088EEE6A062BB8028097D6DEE4F706D606B4687BB910F476FD636941547B02CF38A5D67B2FDED5DB8299E37F34759F5C392E63566E656E3EE04A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

817B.tmp

Path C:\Users\Admin\AppData\Local\Temp\817B.tmp
Size 6.0MB
SHA256 2c66640711c86b26a40f1fa8bd6a174ceb755dd1b339cb08c45acb9c43697fae
MD5 2596d0e1868956f240f534c1e7bb09f3
SHA1 f7411bb60357df5ba1035137aa40ec531dcb252f
SHA512 67fafdda8a513d7c21e9a0b35a81f5ebc3c0b57d18b7a5d4d4aa6cb54ff63209e4535ba586a9ae47dc974ee60ddfb57aadf85dc4993ae45c9d7b76e2eea046cb
SSDEEP 98304:emhd1UryeVWmGAudgULqehV7wQqZUha5jtSyZIUS:el1DpudgU2y2QbaZtlir
TLSH
T11256BF05DBE8EF1EC91F03B590B2222657FAD494E783AFD6A951F1B07E82350BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2268-6-0x0000000000400000-0x0000000000849000-memory.dmp