c55d3aa045b2fbe65bf2cafd1434824c4cf6a306287992fa200a3259b68fff40

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_fc7925343da18798f5493511414f25b5_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260806-lnempsgh78
SHA256 c55d3aa045b2fbe65bf2cafd1434824c4cf6a306287992fa200a3259b68fff40
MD5 fc7925343da18798f5493511414f25b5
SHA1 eed9b8a3febfdeaf0d555072773efba0f6d36462
SHA512 4672c4f80942a77aa1931220c1c6bd01b2cf70611f0c4257ff27c1d6229739afa7238d27d6d69f461b66dc90056132e10d1c7da15e1562db8c17a2fd52800711
SSDEEP 98304:emhd1Uryeshn0iFesf34XxFTPV7wQqZUha5jtV:elMm4pmxFTP2QbaZtV
TLSH
T15A26C00896FCD92DDC2F52F4A1641185C7F0A564E7D3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1040	92C0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1040	92C0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	92C0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_fc7925343da18798f5493511414f25b5_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 1040	3624	2026-08-06_fc7925343da18798f5493511414f25b5_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-06_fc7925343da18798f5493511414f25b5_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_fc7925343da18798f5493511414f25b5_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\92C0.tmp
  "C:\Users\Admin\AppData\Local\Temp\92C0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-06_fc7925343da18798f5493511414f25b5_amadey_elex_smoke-loader.exe 6663BB58989D5CF467876A08110A754EDD68452DB7F169E6E3D8F2A71EC014772317FCE2C9CF8BCFCC709EC91ACF7C2D34113A2340F9759C60A0DEE91735CEE2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

92C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\92C0.tmp
Size 4.3MB
SHA256 18aebe5fddaa5b1b2fed93e90f52adaf3b9c31db02e84c66f173d66781c7ce3f
MD5 5c74d3e5d72f056fee07507ef56a025e
SHA1 cb7b3b9dc8a790e64289913d51d71fe074d6866a
SHA512 8434b02b8dda865ca07ff52e6ea9b1e8f204d116882701cc2f2ee6fd673bc73d7b8939d3c25e694bd883ff744ac4fd5d93bbd99a71791e9a5516642c45352fd5
SSDEEP 49152:Svm2AC0d1XqrdryeJVfMLqmsIzxG5tDyAwLVT5dVXeQqZUhh4r5VC9PI+Kt/N:emhd1UryewqmVzaErV7wQqZUha5jtV
TLSH
T16A26C00896FCD92DCC2F52F4A1641185C7F4A564E7D3AF997DA2F1F02A823A4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3624-0-0x0000000000400000-0x0000000000849000-memory.dmp