a8f0a7e2fc19e3c1310f91158b2de8557804eb21171272bb3d4dbd9f4e9210d2

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_52fed186b5484d0b91acd9e4f062f5ba_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-bavrnavdnh
SHA256 a8f0a7e2fc19e3c1310f91158b2de8557804eb21171272bb3d4dbd9f4e9210d2
MD5 52fed186b5484d0b91acd9e4f062f5ba
SHA1 4bde4d63822fbee023fb4094bb4360a2e3266aa0
SHA512 d35304273f9f0c63b5e2deba1b9bd8ea8cdcd199405233682f80a0e45ec798dec9b15ebc823fa6da2866c7f0ec13292930c7cd360dfad873d382dd09f6cf30ad
SSDEEP 49152:Qoa1taC070dSpgoCBiI3igO6AudiKBiZbAN:Qoa1taC0JrCBiI3fAuoKBiZbo
TLSH
T1E4952314F691C2B1C0850970B5A1C2F69D693E7D96968D837FDC0A3F2CA4EC16B72B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3440	49C1.tmp

Executes dropped EXE 1 IoCs

pid	Process
3440	49C1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_52fed186b5484d0b91acd9e4f062f5ba_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49C1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3440	4588	2026-08-04_52fed186b5484d0b91acd9e4f062f5ba_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_52fed186b5484d0b91acd9e4f062f5ba_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_52fed186b5484d0b91acd9e4f062f5ba_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\49C1.tmp
  "C:\Users\Admin\AppData\Local\Temp\49C1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_52fed186b5484d0b91acd9e4f062f5ba_amadey_elex_smoke-loader.exe 8277B826B604152BEB9AB7D71A4309F2FDA0D390DFB04F7D558DD7FD95EA2A9EE23850094642264AA64D0B574A3B6183CE7DCD16ED69FF9CD1766A44ED530CD4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

49C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\49C1.tmp
Size 1.9MB
SHA256 2226fe7acdd6c0f4c20b3c31da9dbc9da1973fe263e7303701cf3d2c32c2b4e3
MD5 3e0f42333b467e9e8d128d3d6260580c
SHA1 7b3355d33de452fa065c945b353ed08d33eec940
SHA512 5ccbfdbfb28dababb00c649f12f9be79be92b0f2a7512d729e9c41884f0ee91e2f4167f2620568077387b7717d012ff7916d1d8965d4634eae97b315da49e652
SSDEEP 49152:Qoa1taC070dsopY5N5BetUOx7RL18C4yMq9KnqOun0r:Qoa1taC0PopY5N5Bet3JxdZOua
TLSH
T1BE952240F784C2B1C09115B1A291C7D2D87A3EBCA7518D877FCC0B3F69A4AC4AA76B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3440-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4588-0-0x0000000000400000-0x00000000005E6000-memory.dmp