4921eed41714b059acc39af31ad98d96f4563a307afd1c883ab796f2deaa7514

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_8f673c376da0e0e2c474c5445b805bc8_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260805-m2qskaaa95
SHA256 4921eed41714b059acc39af31ad98d96f4563a307afd1c883ab796f2deaa7514
MD5 8f673c376da0e0e2c474c5445b805bc8
SHA1 628c574f9833507ec8a6b968e082c3d273061b47
SHA512 c7ad684ccdfad007e8cecf2d4a81d53f7e37930b48a1edd9441a9390557518b7437a0b007ce13a2638d69594d1e5a11bb493034fd150ab8f2ceaaeb653e6970b
SSDEEP 49152:Joa1tHC070U29bXtBpgaCm+j3aWAQTRp:Joa1tHC0oFmf
TLSH
T110951259FB9481B7D051D8BAE1A2CB63D432387553005ECB27D68F7B2E27AC17634B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4888	26A9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4888	26A9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_8f673c376da0e0e2c474c5445b805bc8_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	26A9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4888	4144	2026-08-05_8f673c376da0e0e2c474c5445b805bc8_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_8f673c376da0e0e2c474c5445b805bc8_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_8f673c376da0e0e2c474c5445b805bc8_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Users\Admin\AppData\Local\Temp\26A9.tmp
  "C:\Users\Admin\AppData\Local\Temp\26A9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_8f673c376da0e0e2c474c5445b805bc8_amadey_elex_smoke-loader.exe F0E85A0B47F2646A43F78D2CE19743AEA70CC66D4CFDF7D1D5C05C31C76A75446430FA40CE6B3D78BE6D56096EC44C9F681B558C488CC3268AE209B115462CCE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\26A9.tmp
Size 2.0MB
SHA256 357cc03a9c69029a4642c748336df5d94294c5cb326f79361ff515d9f15d4d1d
MD5 5832c1c3b0780e3d1b6826072d047deb
SHA1 be57fb648e0857309890e23b1a4a096172fd6e9a
SHA512 bbb103dd4fbabbded61775aae48ecfe59d172c42bc798aff113d33b8ab20519e8c610045a18a5c216aab01ae11286c153c868b1e9383a14d035c363a689f35c8
SSDEEP 49152:Joa1tHC070Um79FTJT6kuqggu7Lr/gV6FlZOp:Joa1tHC0QTJ+govnF7
TLSH
T1C5951259F79481B2E091C4BAE661CB93D5733C7657008ECB23D58B6F1E27AC5B231B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4144-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4888-6-0x0000000000400000-0x00000000005E6000-memory.dmp