9c9bf25594438e8247a8c5ba8e874cc205abcfd3f44b01b60d6b3e7f619552ac

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260807-ntfhasfe74
SHA256 9c9bf25594438e8247a8c5ba8e874cc205abcfd3f44b01b60d6b3e7f619552ac
MD5 5a3befe6517eda60ecc5d9f8b8a5cec7
SHA1 d0a4bfde43d46df23220ebec60b45233c0825b32
SHA512 c441a923c79ece9345933ce80c52342f5b886aa5bb526625c9ae28cdcf6d736313e025ebde21975507c7ef23aecb96dffb65beae61681a2a231b25942ee9d1d2
SSDEEP 49152:ioa1taC070Uh8AM2VC3h39Ul7BWYQvOJFIRU:ioa1taC0T8AVCxq
TLSH
T105A50200B314F0F3C5056FB0665ADB5FA57029FB7B459CC73984278A19DBAC8A712F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
972	45D9.tmp

Executes dropped EXE 1 IoCs

pid	Process
972	45D9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45D9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 972	4120	2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\45D9.tmp
  "C:\Users\Admin\AppData\Local\Temp\45D9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe FEE18A824F7EE148174DC5273EB37FDA78F26A0C5F9DB97C2E672939547E8F622B2D5648A898CF25F2DA143D44FCEDE5EEA4ABC7667868D61C850F97F6A674AB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

45D9.tmp

Path C:\Users\Admin\AppData\Local\Temp\45D9.tmp
Size 2.2MB
SHA256 52ecc02ea4eac473885fccc7badfbcd2715e5086d8772bcdfd334e58942f84ea
MD5 7100cbd569eda0999f02b5cb6d085130
SHA1 51a53c2b2989255f9c3a1d3465305b9fe20f1b6c
SHA512 80d3de951350ee6e34694921b933f7f44a5b819a326f3b277c3c7e33cf31291cda0b2533d7f752f320a148241b709c77427705b8861133664462fcc81a53a54e
SSDEEP 49152:ioa1taC070UNKyMEKCVuJpxZ1t343GR5GK2mqdhrdhCIa5QvOJFIRU:ioa1taC0yRED4Jp/0GRhlyhrufV
TLSH
T1CDA50100B300F1F3C5116BB0665ADB9FA67039FB7B05DC8B7984279A15DBAC89B12F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download