e4e5fc28062475bc1f179842683cc9a03d6cc42aeb31ec5c2e090dedb1b2a251

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_c4486085bdc3ec53edc73d24ce0c6bd1_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260805-y7pcgadh32
SHA256 e4e5fc28062475bc1f179842683cc9a03d6cc42aeb31ec5c2e090dedb1b2a251
MD5 c4486085bdc3ec53edc73d24ce0c6bd1
SHA1 c9a4e0d95016c3e9bd7570da78e2d7d8528aad61
SHA512 9bd208b68093b1d8dc0ab19ccb86d3c3faa7437937cf037f326a33366c113586836a9ab039e73c1a337ef14b8a9bf14840087e95c664bf0df755d3fd872d1dfb
SSDEEP 24576:v2oo60HPdt+1CRiY2eOBvcj3u10Ubg0tqMYEmwOAbmBQZBBQVRNNZrpN8yd:+oa1taC070UEP4mwFbU1NdN8yd
TLSH
T19C66CC10956AF3618A802930997EB159D4E5ADA483FD48F33D8C3AFAD777BE33532601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4760	3DF9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4760	3DF9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_c4486085bdc3ec53edc73d24ce0c6bd1_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3DF9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 4760	5780	2026-08-05_c4486085bdc3ec53edc73d24ce0c6bd1_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_c4486085bdc3ec53edc73d24ce0c6bd1_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_c4486085bdc3ec53edc73d24ce0c6bd1_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\3DF9.tmp
  "C:\Users\Admin\AppData\Local\Temp\3DF9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_c4486085bdc3ec53edc73d24ce0c6bd1_amadey_elex_smoke-loader.exe 259391E3252BD830F8A7D906A3422ED7685C741E24EEC2A062DEB30505A21930B1D3A56A8855981055B783AE75F7B446F9018CFF6C5B87F9F9450C1B651BAD14
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3DF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\3DF9.tmp
Size 6.5MB
SHA256 654920585d4d493e415701c8d919a1dbc2988bacfe227e2e6e5a3646a90f3b78
MD5 0b702eea8a4ca456c7fdb612bf126bcc
SHA1 1fb8486f2b998a4e3f733babb39277fccb302cc0
SHA512 d469f1219fb1f52f6def87c6f6b8517717afda0468a3ba4babf0dcfcdabc543d2724c2e9245b283b5097108bdca25c598279443929a2187b43bf321fbcd1b713
SSDEEP 49152:+oa1taC070UFeuqCwQ9WvgHTGHwpLKd4VnA9:+oa1taC0XJkUL7VnW
TLSH
T11266BC10956AF3618A802830987EB559C4E4ADA487FD48F33D8C3AF9D773BE77532246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4760-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5780-0-0x0000000000400000-0x00000000005EB000-memory.dmp