2bd704bd685e5c2422862081022c81a90b24e9ca877d5d6b141bafb4d7a2efdb

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_cd5463357e1c0e7e0223028654dcf41c_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-wrhhwatzex
SHA256 2bd704bd685e5c2422862081022c81a90b24e9ca877d5d6b141bafb4d7a2efdb
MD5 cd5463357e1c0e7e0223028654dcf41c
SHA1 a76a614b39a514b086cee2e6c011a96e3dc862f3
SHA512 a8db104f56315c0c455217e98ac3b41ccda0dd75a3c8b59e416a67b8743d4a425487f7eb8501b2c1969ac25e73414fc4ba9e923d3c310caaec8fd60f8f58eea7
SSDEEP 49152:Qoa1taC070dG4pD5BhZg2XFLkVZA57vQC51rpku:Qoa1taC0+0k4k7vVjFku
TLSH
T167952354F791C2B1C0850A31B652C7B3E8783E7D9A468D837BC85B2F6864FC02A76B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4580	3723.tmp

Executes dropped EXE 1 IoCs

pid	Process
4580	3723.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3723.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_cd5463357e1c0e7e0223028654dcf41c_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 4580	5960	2026-08-04_cd5463357e1c0e7e0223028654dcf41c_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_cd5463357e1c0e7e0223028654dcf41c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_cd5463357e1c0e7e0223028654dcf41c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\AppData\Local\Temp\3723.tmp
  "C:\Users\Admin\AppData\Local\Temp\3723.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_cd5463357e1c0e7e0223028654dcf41c_amadey_elex_smoke-loader.exe 19D526962A92A18E8BFF61791672C2FA99DFBD3029BD891C8222C32A9B8CDF5E9AF8857CB95F5A35355E2497603A3FC01F01EE0FB6F78F787CDAAC587D69031B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3723.tmp

Path C:\Users\Admin\AppData\Local\Temp\3723.tmp
Size 1.9MB
SHA256 e198920875b7028e4eeac248f828068256bc78842b170e5211830802b7592436
MD5 138f5c011a7dd678c5dedeafed884ed8
SHA1 88f5e5ec958627cad010808c8c1023cfe4af7d0c
SHA512 e8c3d737150715daee01cb6848c7aef138548d7c715175921d67dac12613526c9deb10bd62f3b532579ed8f1a001e0a70db5370d43e8fedb2a85d5d02b09222b
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10df9tvSGa59YfjfJchQbo9T9Jh7nLlPoqnswFs:Qoa1taC070dVtaGDfj45yq7G6qME1QY7
TLSH
T1CF952350F795C2B2C0810A35A151C7E7DC3A3E7C5A428D87BBC82F3F6E64AC06A76657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4580-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5960-0-0x0000000000400000-0x00000000005E6000-memory.dmp