afb66e06c2fc17c9d1db09b67319311fa8ebfdd120c8a99865af7bf2f241c4a2

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_bc24e64415edd40199a62da12db2587b_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260807-p2bpraysdw
SHA256 afb66e06c2fc17c9d1db09b67319311fa8ebfdd120c8a99865af7bf2f241c4a2
MD5 bc24e64415edd40199a62da12db2587b
SHA1 ba13b51b0a4aba293bca8ff9e45b39614b4b9711
SHA512 1fd97542e74f8173585f79b1c01e5e7fc15c4d44b0223bf76d3e14172238a3938c624af65e7065abe4ae92069a5f57f88002b40eac118898cc1ec2f0d76ad2d8
SSDEEP 49152:+oa1taC070Udi3VdIqpE6diBOEVc+/jCRL:+oa1taC0C3wwExBOK+RL
TLSH
T193952355F384C1B2C4810972EA92C3D6A86A3E7D56819D83BBC91B7F3D60FC06A70B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1660	FF2B.tmp

Executes dropped EXE 1 IoCs

pid	Process
1660	FF2B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_bc24e64415edd40199a62da12db2587b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FF2B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1660	4884	2026-08-07_bc24e64415edd40199a62da12db2587b_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_bc24e64415edd40199a62da12db2587b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_bc24e64415edd40199a62da12db2587b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\FF2B.tmp
  "C:\Users\Admin\AppData\Local\Temp\FF2B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-07_bc24e64415edd40199a62da12db2587b_amadey_elex_smoke-loader.exe 7C5191F074B16224296638CE54C661B0285C40CEDEDB4F311973919E2423C3711FCE97F9A3CADC9843E69DFD0E48B82509022327CAF32DB62144F206C7AABBA4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FF2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\FF2B.tmp
Size 1.9MB
SHA256 7968ecd9f5acf599f4bf171efcd1283ba38cef84054086367268f985d22bbc1f
MD5 ca1dff624f1a7897ab5f57733989ff7d
SHA1 4487455fb227c21d1e04ed5a8032827698ba9539
SHA512 921d58cd6718189038c860ef40632f4771400d45c3e7a65b8f4721b8f8c54248f1f19dbeda8395b9b6e0f17c242fd5e881fee1d9345b5dbbe68891567e7643d3
SSDEEP 49152:+oa1taC070UOEPx8lYQ/T+56DmEdP1NyuwxoSF:+oa1taC0gh5tNyuEoSF
TLSH
T17F952261F694C1B2D0C11971A69283F69CBA3C7956428D837FCC1B3F6DA0FC46B62A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1660-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4884-0-0x0000000000400000-0x00000000005EB000-memory.dmp