183694aa646242ea6e1c9e910cd8acd7c7fa88c77481fac24d3e57820864756b

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-tk8els1bmd
SHA256 183694aa646242ea6e1c9e910cd8acd7c7fa88c77481fac24d3e57820864756b
MD5 3e39d5f8c0dfd113daab96a079de4b98
SHA1 8c99c8c027be8067c55ed6161837b48bc9aba78b
SHA512 37cd2a30acdef5ecce9039f195b95a510aab055dc2ed81117bccdc52a9888387372fc809e6eb0aaaa240c7c1249cb4bb5a704c893eaec43c5b7a9fbdecd91b87
SSDEEP 49152:Qoa1taC070deG8aat2VlQHtCpq8gvM5TQ2w1yLo9W0uk2:Qoa1taC0XqaYKCp5KM9MULd0uv
TLSH
T1B4952210FB95D2B2D0811632A656C3BADC793E7D46419D837FC8173F2AA4EC0AA32757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1776	2DFC.tmp

Executes dropped EXE 1 IoCs

pid	Process
1776	2DFC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2DFC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 1776	2748	2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\2DFC.tmp
  "C:\Users\Admin\AppData\Local\Temp\2DFC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe 1776C5AB065537039E52E531B018C7A2F7B610E0FEEBA9E16A7291DB5E35AF2AA0E8BB830DF9AFFADA1EB5F1208915B770BD7358C7BB81FE6C7EC3B0B78F1704
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2DFC.tmp

Path C:\Users\Admin\AppData\Local\Temp\2DFC.tmp
Size 1.9MB
SHA256 f206fadfe32fc445a214a493789ad32b2d8b307edd5882f29f9c677921b6716b
MD5 a659f200cd392d64bdfafe27fcc0d695
SHA1 35da892b81d65b71e2ec3107ba020362838e4c47
SHA512 1e0201c83e386b0d36b5740dfdbe0391e7b4ea3e18c0052396d4b9fc457f47d225112fa1f13c69a55bab0f9c871913ed82d04a36c399036860c9aa4451b32146
SSDEEP 49152:Qoa1taC070diUonttDunP/O0zxmoWhofNsARPrQGhj:Qoa1taC0B/nDuXTFWErlhj
TLSH
T100952210F795D1B2D48516B0E652C3E6A87A3E7E46419D833FD80B7F29A0EC0AB72747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2748-0-0x0000000000400000-0x00000000005E6000-memory.dmp