99ff6d574a8b8941a9383a3cf29136380c186eb093498971250a6abdf8d0fb57

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_5dd18a72838551d21c2322d4cfc62845_amadey_elex_smoke-loader.exe
Size 5.4MB
Sample260805-w4gr4sdd48
SHA256 99ff6d574a8b8941a9383a3cf29136380c186eb093498971250a6abdf8d0fb57
MD5 5dd18a72838551d21c2322d4cfc62845
SHA1 6debd63697b64064f80e52afab27d755df36f16b
SHA512 ba27dc5889138d28b1707437d0fc5340fc5fc3c54a219f0f04f713aaf9e92a9451aabd975900067aa717dfb4b0b67c5e3032e3018b21cb90db862568b2d39e5d
SSDEEP 98304:emhd1UryekQ4/f+OCHxoQ+0JV7wQqZUha5jtSyZIUh:elEp+B6Z22QbaZtliU
TLSH
T15D46CF0486FCEE2EC91F41B5E0A122669BF1E964E7C3AF967C52F1F43943350B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4200	95ED.tmp

Executes dropped EXE 1 IoCs

pid	Process
4200	95ED.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_5dd18a72838551d21c2322d4cfc62845_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95ED.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 4200	5312	2026-08-05_5dd18a72838551d21c2322d4cfc62845_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-05_5dd18a72838551d21c2322d4cfc62845_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_5dd18a72838551d21c2322d4cfc62845_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Users\Admin\AppData\Local\Temp\95ED.tmp
  "C:\Users\Admin\AppData\Local\Temp\95ED.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_5dd18a72838551d21c2322d4cfc62845_amadey_elex_smoke-loader.exe 328A25A5759E3D847613D3F31E926CA13E3C99E2DD775F40615FACB79D1F85130F1739EC2781BEA886C5C58705EBBAE4AC464132ADE70C75F1D72CB37F9D86DE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

95ED.tmp

Path C:\Users\Admin\AppData\Local\Temp\95ED.tmp
Size 5.4MB
SHA256 8d4efe35aa3979ba67d9ba8bf3a7fe09b19b423ec0bb881c45f8e62d940bce25
MD5 4116af6f0053d10845c681ebacf93722
SHA1 231962b33099550ad5a9dc53eb22ba6d1cc168ff
SHA512 b115dd9644e89b790722f24558a18f17e4965d002ab37260e4c1538f6d69ceba29c8ab60b99fc96e7ddc414872d659c4322d37246c77b5ecb03ab100c840115e
SSDEEP 98304:emhd1UryeLqiEhcNGqst2A78oV7wQqZUha5jtSyZIUh:elm3uGDwo2QbaZtliU
TLSH
T12746CF0486FCEE2EC91F41B5E0A122669BF1E964E7C3AF967C52F1B43D43350B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4200-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5312-0-0x0000000000400000-0x0000000000849000-memory.dmp