85cdca390ea5fdaaeeb2f2d2e9ee099ccb39811db711155c33faf2341957b071

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_f6d8c4264e6d3efc790d82362c6baa23_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-yslm2avend
SHA256 85cdca390ea5fdaaeeb2f2d2e9ee099ccb39811db711155c33faf2341957b071
MD5 f6d8c4264e6d3efc790d82362c6baa23
SHA1 d7b197884b2962b49487bd4f8e0e56849d7e4353
SHA512 9f17aec1868bb3ec95ff552cdffe6bbf5836be4d7e8bd20297222b8afe599cf29229df2a68755945132b6e8927e09961c1bf1b953e94e6c75dfa8ee3ff7ab109
SSDEEP 49152:Qoa1taC070daF1N4hbnv/1tLSSjdzNcMuglXzntZH:Qoa1taC05FYhb7LSS5RsWznj
TLSH
T154952290F7C1C1B2C4811A76A191C3E79C692EBE52418D837FDD1B3F29A4EC42A35B67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4108	6066.tmp

Executes dropped EXE 1 IoCs

pid	Process
4108	6066.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_f6d8c4264e6d3efc790d82362c6baa23_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6066.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4108	4464	2026-08-05_f6d8c4264e6d3efc790d82362c6baa23_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_f6d8c4264e6d3efc790d82362c6baa23_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_f6d8c4264e6d3efc790d82362c6baa23_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\6066.tmp
  "C:\Users\Admin\AppData\Local\Temp\6066.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_f6d8c4264e6d3efc790d82362c6baa23_amadey_elex_smoke-loader.exe 8544B8701213F0FCD6EC3B123A877A0861710EAA822EAE808468877ACEAC607611573CF1EB3E6BB4F9DCD43E3672A88CCD602B578676C7D59898A04692EE11C4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6066.tmp

Path C:\Users\Admin\AppData\Local\Temp\6066.tmp
Size 1.9MB
SHA256 e51cc720f2eb34623118deacc58ceac5ba98dffeb1afda7230565572fdcf5dba
MD5 078d6f6666331250c897b9e540c85dc3
SHA1 11a7034eba170bc4fcd3f6371d04b67b4bed36f1
SHA512 d916510d54ee9382b04d29d7567de6d637e5422880e28e04605eef0d838b49bbdfbeeb06b0f968f50e8b9fb85eb016c1bdfa8279e1dd7d9f657a2fa2d6be218b
SSDEEP 49152:Qoa1taC070dPLVbfinAyej1rdRqPbsRafUQSx:Qoa1taC0ChjBrdhYf6x
TLSH
T166952250F7D2C1B1D0810A71A9A2C7A69CB93E7C47408C877BCD2B7F6950EC06776A97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4108-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4464-0-0x0000000000400000-0x00000000005E6000-memory.dmp