c06cbbd8186b6cbe8091178acf429f4c16ad0413628d555cc308806672ae4ba2

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-acchestcpg
SHA256 c06cbbd8186b6cbe8091178acf429f4c16ad0413628d555cc308806672ae4ba2
MD5 f72f43b4055d70be1afaae42695c4fb0
SHA1 f2b845ca364179ebce645432044a71e60443a1b4
SHA512 99bf62b0dc09b87a45492381f359454471cc5a45e3bb652f34b7d0191521d6a9aa0d52d54ff3feb891c32484a783fbddfbc99b1048fc4dec57afe23c60b7ed82
SSDEEP 49152:Qoa1taC070dacT5mgPKIHG1ZfwYOOQzQgN8:Qoa1taC09ckgPjQZfpOOQQgW
TLSH
T127952290F7D0C1B2C0815A70A591C7E6A8797E7D8641DD43BBDC6B3F2DA0EC42A62B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4056	E4B9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4056	E4B9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E4B9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4056	4700	2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\E4B9.tmp
  "C:\Users\Admin\AppData\Local\Temp\E4B9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe 1E8DCF80613298F58252AC91AC5210EA8682D3638E55F5F332442653CB622118CEFA9C1E52B2744243206DCF8DDC403506A430E12E442832325159601983158D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E4B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\E4B9.tmp
Size 1.9MB
SHA256 d3f50611557602c227153e0374cbfcb68af5ca8c05c2dc1745c9b340784c2a06
MD5 034364802b933b9fadf348c00ee99f56
SHA1 7248857577a92f4df83a2d0fa8cef6ec414f6edf
SHA512 b7b7bd56b70296543a664fdadfd3aa0a71fdee5364a5d0187b8b17012a55d043b150e5374f61d6dd4f941390ff5db65ba2c12377008ad651ac838c7ccaf87645
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d1WyqEJR1WJ6zvEHKJD3vXI00R3GyXfmZgdg8:Qoa1taC070dpYHuv03WZgdgqWNnDV+
TLSH
T183952325F691C2B2C4824A70F551C3B2DC793D7C96419D83BFC91B7F6AA4AC4A632A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4056-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4700-0-0x0000000000400000-0x00000000005E6000-memory.dmp