aaf45a36bb2a1559bd3331268cf7b7fd75573ce44724c08105ded47574a7e564

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_509ab91e5f2335105353eedfad9fe1d6_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260804-y3deeagd66
SHA256 aaf45a36bb2a1559bd3331268cf7b7fd75573ce44724c08105ded47574a7e564
MD5 509ab91e5f2335105353eedfad9fe1d6
SHA1 7fe3de26d03f096917908e0c5b15799a76278f6f
SHA512 84d27bb4da5c72834bb8aeaba5b0e30f65628505444d9e772ce591c600edebb9336eb4c2db44efc24d4bbf371db7bd04df41c570e773c9c3d36c95ded91e4344
SSDEEP 49152:Svm2AC0d1XqrdryeJV79ZEI3TFrUtS7wysvXGwLVT5dVXeQqZUhh4r5VC9PI+KtV:emhd1UryeFZR3JN7wtV7wQqZUha5jtV
TLSH
T1DE26CF0896FCD92CD82F52F4A1641185C7F4A564E7D3AF997DA2F1F02A823B4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2412	8C29.tmp

Executes dropped EXE 1 IoCs

pid	Process
2412	8C29.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_509ab91e5f2335105353eedfad9fe1d6_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8C29.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2412	2208	2026-08-04_509ab91e5f2335105353eedfad9fe1d6_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_509ab91e5f2335105353eedfad9fe1d6_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_509ab91e5f2335105353eedfad9fe1d6_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\8C29.tmp
  "C:\Users\Admin\AppData\Local\Temp\8C29.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_509ab91e5f2335105353eedfad9fe1d6_amadey_elex_smoke-loader.exe BE88A30B0D6BB9D926500D43CEFEA90230E710450B899CCF2E2865A9AAAE9E9AF3F0798FF2C812F5C7D51FB60CECDD91FF0BC68B9266C17E113CAEE2161DA349
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8C29.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C29.tmp
Size 4.3MB
SHA256 32a8b34157a970431298b12fbc26b8a8e72ac0d67a6c5e3d4eb93160068c9067
MD5 60c95f437856dc7401e346cc858c8fc0
SHA1 050cf44e8dec7150804440e6cda1400a018596a1
SHA512 a3f31bc8de04c217cc77696082b0303c865b39fbd0b0619453f95356e52244f2c3a28425360d53e2b2a4241a4388ef08b538dbaf7146b49c444be11dec80e4e8
SSDEEP 98304:emhd1UryejlrdmlbstTdUV7wQqZUha5jtV:el5hmxgTdU2QbaZtV
TLSH
T1C826CF0896FCD92DDC2F52F4A1641185C7F4A564E7D3AF997DA2F1F02A823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2208-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2412-6-0x0000000000400000-0x0000000000849000-memory.dmp