de57b2be55e466cdef696c5033435f6fbd3a8b665f84dd43ac02fc89bbc30ecc

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_698998f531b4a4f2183ae72d1bbb7e35_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260806-yepsjahn91
SHA256 de57b2be55e466cdef696c5033435f6fbd3a8b665f84dd43ac02fc89bbc30ecc
MD5 698998f531b4a4f2183ae72d1bbb7e35
SHA1 496d6b054cd6d5bb2003b4681fe6cee28a6055df
SHA512 ef67675fb18de6d3011c25735341c3bd7639fb032156fa34a687c615da97871a695a98ffc2112fc7a46d51609b917afc6feda3ce95834846ba3cd6e397783964
SSDEEP 49152:Qoa1taC070dJT0ip2Fxc0x3bg0EFRHUjvPQEps4oy:Qoa1taC0ripAx3bdEzUjXQc
TLSH
T18A952351F785C2B2D0854632A262C3AAE8653E7C56414C877FDD1B7F2D62FC06A72B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4324	83EC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4324	83EC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_698998f531b4a4f2183ae72d1bbb7e35_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83EC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4324	2776	2026-08-06_698998f531b4a4f2183ae72d1bbb7e35_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-06_698998f531b4a4f2183ae72d1bbb7e35_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_698998f531b4a4f2183ae72d1bbb7e35_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\83EC.tmp
  "C:\Users\Admin\AppData\Local\Temp\83EC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-06_698998f531b4a4f2183ae72d1bbb7e35_amadey_elex_smoke-loader.exe 64BE4B6947C8985BE0C6AD0092201DD2ED302635A43E534A084A051D84790B6B5E36F313E2B87AA378A22608BDE54D0B02A0AC284C6B7F4B81A7046F0DFA1B45
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

83EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\83EC.tmp
Size 1.9MB
SHA256 751e108ec3a81293d2a2d341bbef3d0e6b39df04828a8dd751a1144946b98417
MD5 895febaedf1d6ab602a2f0f9bd98c725
SHA1 1da4a69a49bb1a28a6159b5548745e264f989a8c
SHA512 6df0ae7a539302d17c0c2892246f1fc37f97c755c5bee4c9f9d21b8645984d8c709444d4c7278e1b5e05e3292f1957b22391ebec6046482c9253460fc2ead85d
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d6sm3aylPdRxDJR59jS8g69nPzjqq3idYSE:Qoa1taC070d23a+Txt5jS8HNPzjTR
TLSH
T1CA952365F7C8C1B2D09109B1A2A2C3E2DC797E7C97469D837BC81E3F2950EC466A2747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4324-6-0x0000000000400000-0x00000000005E6000-memory.dmp