a52a18b2b0409e6da90ca506fa96079999b69317e2c9f0d76c2683930d7b94ed

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e57dacefa935ed7aca8b35873518322e_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-warp8atwfs
SHA256 a52a18b2b0409e6da90ca506fa96079999b69317e2c9f0d76c2683930d7b94ed
MD5 e57dacefa935ed7aca8b35873518322e
SHA1 261e6a1533fe2c39642c7a3ddb90faf6242edaad
SHA512 20605f7c8abc4b618dba994522d3ef11b1fc7f9b620bab636023e0395521c4b332173d31a692703c5fb67e3de29329c02416aad284fa7185ed973d1c5e24e4cc
SSDEEP 49152:Qoa1taC070d0WBr4qFoNoU2PVQMEccAbH1k:Qoa1taC0s94w1n6dEH1k
TLSH
T1C1952315E381C1B2C0820635A6A1C7E7DCA93E7D57459D837BC81F3E6D61EC0AA71B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4232	5EC0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4232	5EC0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_e57dacefa935ed7aca8b35873518322e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5EC0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 4232	944	2026-08-04_e57dacefa935ed7aca8b35873518322e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e57dacefa935ed7aca8b35873518322e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e57dacefa935ed7aca8b35873518322e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\5EC0.tmp
  "C:\Users\Admin\AppData\Local\Temp\5EC0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_e57dacefa935ed7aca8b35873518322e_amadey_elex_smoke-loader.exe 92581CCD74E14A334F04FA36F48A357EC04719FAC542FCDFC495B73EF69E986BE013E508A842515C99DC8CEB1615BF84EB149900A68C3E3F2CB41E56D000C0CF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5EC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\5EC0.tmp
Size 1.9MB
SHA256 eee598ec4b0cd1b7aa9b02d93962e63b565033c4a045dd6452108a23caa84eea
MD5 4dd52af089a87882f346a30eac167717
SHA1 69d08de57d5b2dadbb388520f6941b718222c9c8
SHA512 fcca98ed67eddae51670764857e36aeeb19208aa7367e5f91756e0821a6baf255372a12506a153d82009b1d2ee67ab5c8fbe4c6008895b9d17168cd08ae0e76a
SSDEEP 49152:Qoa1taC070djiJ9Tk2blOWV5aA6w+wp2GqKt4:Qoa1taC0I2Y2blOuaA6WpJqc4
TLSH
T12B952360F791C2B2C0811A75A1A2C7E6DC7A3D3963458D837BDC1A2F2964FC0AE71797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4232-6-0x0000000000400000-0x00000000005E6000-memory.dmp