f7869181252ea5c1832ed4be93dbf0bd04b1c95fe3ca460e84ab26468ff542fe

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_d91097075a5567d5474eb1740c6d1467_amadey_elex_smoke-loader.exe
Size 5.4MB
Sample260808-gd5c6a1dpf
SHA256 f7869181252ea5c1832ed4be93dbf0bd04b1c95fe3ca460e84ab26468ff542fe
MD5 d91097075a5567d5474eb1740c6d1467
SHA1 a349b2622b589e273a52052b3163831e08cdce15
SHA512 c45ab1dbaeb0764ed495b7377d4951391871b430e448c7b41b5c9aee211586045868434e94746f762f2c2db72fd788d76acbb93f295a51a3ca89e6e78f742b9c
SSDEEP 98304:emhd1UryeThu4IF+V7wQqZUha5jtSyZIUh:elzhu4E+2QbaZtliU
TLSH
T14646CF0486F8EF2EC91F41B5E0A122669BF1E964E7C3AF967C52F1F43943350B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4784	DADA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4784	DADA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DADA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d91097075a5567d5474eb1740c6d1467_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4784	4136	2026-08-08_d91097075a5567d5474eb1740c6d1467_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d91097075a5567d5474eb1740c6d1467_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d91097075a5567d5474eb1740c6d1467_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\DADA.tmp
  "C:\Users\Admin\AppData\Local\Temp\DADA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-08_d91097075a5567d5474eb1740c6d1467_amadey_elex_smoke-loader.exe 3D46929717916BAFB6F5065FECDDB62E32B99DEE48D71A1DDC932F8B04C2993663B190BB261E171D962A5CC82403AC22EBAF54570A7F85762ABB1E78424E1147
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DADA.tmp

Path C:\Users\Admin\AppData\Local\Temp\DADA.tmp
Size 5.4MB
SHA256 d34fa39d23e0ffd5d3acd121a4badf1e13686b7c69cd4f3bb890bba0bbe1d846
MD5 17c4db126fc90d6a1f7c98e9d27c6431
SHA1 dcae8f41437a9d69c4a36e88e5b0d3941fa28f53
SHA512 2088beb11ca13070110511ecd0c3cdf33de9a50f9b07273e0744f9fae4252de55d95eb0208860bf2871c2612e8e979d2f696af985eb26235541811908a1f9667
SSDEEP 98304:emhd1Urye33gMQ8HxizLok1NPHyFzJztsf4S9V7wQqZUha5jtSyZIUh:elHgMfizsk1JHWtta92QbaZtliU
TLSH
T1EC46CF0486F8DF2EC91F41B5E0A122669BF1E964E7C3AF967C52F1F43943360B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4136-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4784-6-0x0000000000400000-0x0000000000849000-memory.dmp