fc1c2752500b49f37c04f5bf046aa052ca53c65312edb90b80d2028325f203db

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_99040f1778270908d6c4e0a950950959_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-zhx4rawcmf
SHA256 fc1c2752500b49f37c04f5bf046aa052ca53c65312edb90b80d2028325f203db
MD5 99040f1778270908d6c4e0a950950959
SHA1 1ef0cdaa25be04c4c7b928331509327ee05224b9
SHA512 599c660f6b8c28c20c31aebefbae4cb080952b644d90bb51a2436267aa55671ae006ed0ac1aee271c5299a927edd824556fb561b8f7eaa38204ea398f96d7fb4
SSDEEP 49152:foa1taC070dEsVcvinwrdLu309SWgkwrr7:foa1taC0Bgn2BB4WAv7
TLSH
T15D952310F795C2B1D0910971A691C3A2D8BA3E7D46858D937FCC0B3E6AA0FC05A72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1844	4ABB.tmp

Executes dropped EXE 1 IoCs

pid	Process
1844	4ABB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_99040f1778270908d6c4e0a950950959_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ABB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 1844	3344	2026-08-05_99040f1778270908d6c4e0a950950959_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_99040f1778270908d6c4e0a950950959_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_99040f1778270908d6c4e0a950950959_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Users\Admin\AppData\Local\Temp\4ABB.tmp
  "C:\Users\Admin\AppData\Local\Temp\4ABB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_99040f1778270908d6c4e0a950950959_amadey_elex_smoke-loader.exe EE0B929981A736C6E5C9277865F7EB0D7F6E6EE528D4195B80A3055897C718E38A52FB6484B6CB1EB838566051D10448EEE096A3BEAB3B32CC5CD723EB4B1F92
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ABB.tmp

Path C:\Users\Admin\AppData\Local\Temp\4ABB.tmp
Size 1.9MB
SHA256 1bab9e194c78f3d32b7c4b042b42d8b44642b9d9ab42cffc36cdf4825525efc3
MD5 ea682362bf23f87b566eb12e1f379e9b
SHA1 ab558d1379fc1e80ec899c9ce44ed02c51ca1429
SHA512 914caa1d4d996b8cb6f2854b12d6c8f36b8f710e2df352f03a0adb79e56050487520f7374b993dfbf4c6bb6dd95f1e2a5d83cb100e3b7e890556b5fa8710a58d
SSDEEP 24576:u2oo60HPdt+1CRiY2eOBvcj3u10dbujGam5ubW83vMcYBoupHIEjJo69soskVJ3M:foa1taC070d6QMoxBoupHIEutqVJ3Vto
TLSH
T1C5952341FA91C1B2C0851672E591C3E7E8A97E7D56026C87BFCC2B3F1DA0EC05962B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1844-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3344-0-0x0000000000400000-0x00000000005E6000-memory.dmp