c50886664cfbbf8e510b150f1af80d36eb70a53a5aeca16ff1fbbfc002c28824

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_23967251c158f03d6a8d97e7cf9379be_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260806-3d8w8swtew
SHA256 c50886664cfbbf8e510b150f1af80d36eb70a53a5aeca16ff1fbbfc002c28824
MD5 23967251c158f03d6a8d97e7cf9379be
SHA1 0c1466265ea08f7d8cca40b75dce43c47bd12759
SHA512 83901c24a3fd493b85253c5f5b0fe89aafcf638dddcd07d3b2f3a891ce5f402c44af5b00be59d6b0e79bfe5e641995a8e93d1d69c04a2a4b7e8e4891613e7aad
SSDEEP 98304:emhd1UryeyKFDK5+7TQ8ZFAbywZVLUjH5oxFbxCVLUjH5oxFbx:elFFO5qU8FmygVUjZEdCVUjZEd
TLSH
T107262390B7D4C662D1C275F9608343DAD5743F2D067AE98F2FCE2A1EEC698E171B4242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2404	EEEA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_23967251c158f03d6a8d97e7cf9379be_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EEEA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2404	4932	2026-08-06_23967251c158f03d6a8d97e7cf9379be_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-06_23967251c158f03d6a8d97e7cf9379be_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_23967251c158f03d6a8d97e7cf9379be_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\EEEA.tmp
  "C:\Users\Admin\AppData\Local\Temp\EEEA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-06_23967251c158f03d6a8d97e7cf9379be_amadey_elex_smoke-loader.exe DBA4C88FCEB976C9F5F90F36E8AD2FA3BE65D5A98FD6459815899D00A260AD9A208A362BC351DDD5E9E26EF019152646F1C929CF8D572110FCF99A7043DA9B00
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EEEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\EEEA.tmp
Size 4.2MB
SHA256 0171a7d0104d0213f1fb77e9e92b7cecd6a94b541db756a3429d8f2a94f173a7
MD5 dc806494204472f2a2ccf4d283fb7190
SHA1 bb48e8b989e16bf66a3252c967be23e389a6a5bf
SHA512 f0d4bfbbcbfecfc112986eb747016a22acb879b33164306d136db98ab28c1853110f39dc0f2c9f024ff8469f214de82faf1ea2830603a8567dcb476edb1ddf34
SSDEEP 98304:emhd1Uryex4e4sKzNQwRsrJ/P6dwxoVLUjH5oxFbxCVLUjH5oxFbx:elz4sKSwEJX6VVUjZEdCVUjZEd
TLSH
T159262341BBD4C371D08235F970C383DAD6383F2D5526998F6FC92A2EEC649E27678252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2404-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4932-0-0x0000000000400000-0x0000000000849000-memory.dmp