ea57c01b367a161b938d108bda6a355fa5d3936c48dc0bc231500ed91ecef6a8

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_31e7b4bd85617292dcac58587bc29c02_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260806-3bhbhashjd
SHA256 ea57c01b367a161b938d108bda6a355fa5d3936c48dc0bc231500ed91ecef6a8
MD5 31e7b4bd85617292dcac58587bc29c02
SHA1 0a29c7035e496052a044ffafa0fc6a5f9b69ae10
SHA512 1657488cd270e4ef640eba784dbbc8839e9bcf53629db0635ae9fbf4b90c428b75e7857136f7eb59c37a39d5961ea775486ce3e37caa925e508cbde663419305
SSDEEP 49152:Qoa1taC070dnE/7mVE9ZIYO1UNKVP/L2vml/:Qoa1taC0EE/7msZbSUG/i+d
TLSH
T10E952240F795D2B1D0814670A162C3969CBA3EBC83459DC3BBC91B7F6DA4EC02636B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5060	7843.tmp

Executes dropped EXE 1 IoCs

pid	Process
5060	7843.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_31e7b4bd85617292dcac58587bc29c02_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7843.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 5060	4996	2026-08-06_31e7b4bd85617292dcac58587bc29c02_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-06_31e7b4bd85617292dcac58587bc29c02_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_31e7b4bd85617292dcac58587bc29c02_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\7843.tmp
  "C:\Users\Admin\AppData\Local\Temp\7843.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-06_31e7b4bd85617292dcac58587bc29c02_amadey_elex_smoke-loader.exe D892FE24515C98D0336C9CF196BDBB0F90C13DA9C3A810A14FF01AB01DFCC065D3CDA28DCBF1DD354463C84E2EE22181FAF5D1EBE961A7F23A8CA290F23F3B5A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7843.tmp

Path C:\Users\Admin\AppData\Local\Temp\7843.tmp
Size 1.9MB
SHA256 d9494279e354f8ffbe02c2b6e6a537a3636c8738c82ea69e9c411758df480c4e
MD5 53661db260f266e80798880db8fc5432
SHA1 9b662e504882a946031883447681bac39a8d96a1
SHA512 f7147d149b3a1244823c3d5d6e8619281a314a03c3e33dfdabb0ea268facfe24f07fc3d2787319d0185c4ab0793bcb28642ed458b7db12435c19e8651f770639
SSDEEP 49152:Qoa1taC070d7tddZpN6WwjblTdIyKJIPhJMOyBU/:Qoa1taC0yvNABxrKJWJMON
TLSH
T133952210F7C8D2B2D4810272A591C3A6DDB93E7817519CC37FC90B6F2964EC1AA39B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4996-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5060-6-0x0000000000400000-0x00000000005E6000-memory.dmp