c703acd5c30ab9704ea93f7f8f25a7c3e5f1c001cf8ec5100c77cc50e7a7b404

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 19:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_23932faac358b259f05a07564e9f2c08_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-xq5gpathne
SHA256 c703acd5c30ab9704ea93f7f8f25a7c3e5f1c001cf8ec5100c77cc50e7a7b404
MD5 23932faac358b259f05a07564e9f2c08
SHA1 bb77ff1c207bd1107ae10b58d08409c931b196a4
SHA512 98e87a7ea44ae24ddf54ffeab287a4c8c6c5c361182245b6e92e286ca5d1c1eddf2a8c4e2fdba777c2971838bd5895710a6d3c04178bd992e37e969e621c1cb1
SSDEEP 24576:N2oo60HPdtV1CRiY2eOBvcj3u10rw0EU93TJt5rv6EJ3kf6SKliW6FdhdAMcPj8w:Qoa1tLC070rF7dt7k2Ahdsepde2i
TLSH
T1EF952250F3A5C2B2C0820AB1A6A1C6E6DC693EBD56418DC77FCD1F2F18A0ED45A72357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4236	6C0E.tmp

Executes dropped EXE 1 IoCs

pid	Process
4236	6C0E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_23932faac358b259f05a07564e9f2c08_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6C0E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4236	2532	2026-08-05_23932faac358b259f05a07564e9f2c08_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_23932faac358b259f05a07564e9f2c08_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_23932faac358b259f05a07564e9f2c08_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\6C0E.tmp
  "C:\Users\Admin\AppData\Local\Temp\6C0E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_23932faac358b259f05a07564e9f2c08_amadey_elex_smoke-loader.exe 28AE937092A3FB5042677BC4D5FBDF23697A375AF70F32B4D9C35FB24124CE64F6BB87E4E330B471C27B33132F7BDB0704FF54957D0DB64AFC54C5CF4CE65404
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6C0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\6C0E.tmp
Size 1.9MB
SHA256 29de58e7a3ae7e175fdacef557378dc26dfac46877b2d3ef1bc70b4e706586d0
MD5 13a0d808e4e4b810bf0f847bafd35661
SHA1 0feea15085d3c96c4d829f65d9b0f3d4515c8f8e
SHA512 016b0260167712fcb139efb46aa770fc002139391e4a6773eec426e198fab0ca15aba61476bd232d5d98d23e0fa99bc9c42a1f6d9fc6592c8224b186749d1515
SSDEEP 49152:Qoa1tLC070rZL/vAWQ6kBMctyPoHxksJzRX7:Qoa1tLC0KYooHxjJlL
TLSH
T1A8952355F395C2B2C0C50672A592C7E7987A3E7C96464C873BC91B7E2970FC42A72B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2532-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4236-6-0x0000000000400000-0x00000000005E6000-memory.dmp