d2f3422befa25f6f6e28a2f45afe2f9f81789bbf16230536e6f501b06aa023d6

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260807-tek25agn71
SHA256 d2f3422befa25f6f6e28a2f45afe2f9f81789bbf16230536e6f501b06aa023d6
MD5 6cefe5d0a4f3a4a9cbac8074c536cef9
SHA1 5d933d859b9fef2a30810a87560d63b65f3bbd08
SHA512 5d7b0bba5de62e4acc7a65f630f9c7ccf25dadeb648d8ad1a13e65dbce5a105fd3e1e1cdf12dfe109c7ed537370ea74a6361ba47b6774686827cecaa1596ca08
SSDEEP 49152:4oa1tEC0706YdzyrfwUT/voaruB2IADt3OS:4oa1tEC0EzyrfwUT/U2IADF/
TLSH
T10C952361F7D1C1B2C0420631AA92C7A3ED653DB89B059C87BBCC1B6F5D90BD06B62B53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4144	C38A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4144	C38A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C38A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4144	2904	2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\C38A.tmp
  "C:\Users\Admin\AppData\Local\Temp\C38A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe C8D6D13C522FA2298F9EA88EE16C9FB8D3D8BBFC1B3B6803A0D33343577E52892503DEA584DD2BF41B697666608E69D212C2B6B948E0F773C4B18773478B7EA2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C38A.tmp

Path C:\Users\Admin\AppData\Local\Temp\C38A.tmp
Size 1.9MB
SHA256 0970e473bc71a60d5ba3a03524cb13347dd40f0eaff5f7d726d56ddb05df13b5
MD5 afaf5ba5c22edd3fa1ae88eb45ee4581
SHA1 a856ea4ce302059772bd418d411820e84eb34b79
SHA512 924a9565406e21d5d028dd09f6fa90f8fe6f57f24c00c0617028f242e8215f0b9712edf360abf44f5fe7bc24e76a8f97a42294c34429047e174ba17e5f4f3e83
SSDEEP 49152:4oa1tEC0706NvAmEWzQFK/u1ZmkOi3aSO0phkMc:4oa1tEC0xGF9yI3aft
TLSH
T152952324F7A4C1B3D4424AB5B251C7F398B93D7C86914CC3BBC81B6F29A4EC06666B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2904-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4144-6-0x0000000000400000-0x00000000005E6000-memory.dmp