2f44eb99bc03047e8fd9f5c2d6ad2a67c425ea1fd537daec4d2856e7b6b1f9c1

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_b53d20e0282e35d584824a0a46da1ee0_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260806-2ms2psvwhv
SHA256 2f44eb99bc03047e8fd9f5c2d6ad2a67c425ea1fd537daec4d2856e7b6b1f9c1
MD5 b53d20e0282e35d584824a0a46da1ee0
SHA1 0054f36164f6e3ad34c63469384b177ee723a4e2
SHA512 b847a91f5b1ba404e6d5b84790efdf0894955b85a6eb1f9611eededf967b482bbf7584107f33ee09718792f7f5bb0986e058495329e517dbd3682698c3089693
SSDEEP 49152:Joa1tHC070UoFWNPoRNg+nrlAD6197ejT6W:Joa1tHC0aSoRJrlujTR
TLSH
T1AB952224F790C1B6C0814A71A462C3D2D8753EB997558CC7BBC85A3F2A74EC47A36B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3608	862E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3608	862E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_b53d20e0282e35d584824a0a46da1ee0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	862E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 3608	5648	2026-08-06_b53d20e0282e35d584824a0a46da1ee0_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-06_b53d20e0282e35d584824a0a46da1ee0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_b53d20e0282e35d584824a0a46da1ee0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Users\Admin\AppData\Local\Temp\862E.tmp
  "C:\Users\Admin\AppData\Local\Temp\862E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-06_b53d20e0282e35d584824a0a46da1ee0_amadey_elex_smoke-loader.exe 5479DDB6192682B03339146E399FBB9218BFF12657AB2FA3470EF90F04DEB728B9B8284E4CFB3C6E80EA7D130E01C59C6AB87E4916BD94C5B060BB5D9E4C3B2F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

862E.tmp

Path C:\Users\Admin\AppData\Local\Temp\862E.tmp
Size 1.9MB
SHA256 dc855518655ea8bf6b8d0802369c82557fe34de44c51110cd3b35634f8fb1923
MD5 4f361575d5c0452beac2f9ab17f24ebb
SHA1 5d9400ff5192ef29c1cb1e2b3bbb71516f185bce
SHA512 8253259e5b4ba78aa1c77b0240c38a48cce8f673d099bde0b7ba186a32ac8cd7016e4ce83f2aaa825e5e8b85467c63e3abc7ac7e821508e78fe30a1ec0bb5400
SSDEEP 49152:Joa1tHC070UoaN3P6IgTIEEV3neZW6XkxRX:Joa1tHC0eZ8EEZnUW6UjX
TLSH
T1DC952251F795C2B6D0928630D6A1C7E2E9663D7C47059C836BC91F6F2961FC0BA36B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3608-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5648-0-0x0000000000400000-0x00000000005E6000-memory.dmp