1b338b553a2dea9526bbd78291f31b880c18aae5cdf238e82b788ece0d5f58cb

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe
Size 2.3MB
Sample260809-fkhbjagg45
SHA256 1b338b553a2dea9526bbd78291f31b880c18aae5cdf238e82b788ece0d5f58cb
MD5 cf5d9275c124e5ffc1f1bd3a3042486e
SHA1 b6226b80bd67eca1297625727a6ce04656848726
SHA512 b5c5ebbedf0fefbed96ea6d4e72c771eb0ef69396dd922d03f1201fb1ce9a05446ae1ceb9aafb80f7c366e860b134836f3ba03718828f5c0f97396723005f76c
SSDEEP 24576:r2oo60HPdt+1CRiY2eOBvcj3u10UG2YOq9kPvrd2hx2LpBJZiV8DZUBJ7SCU4ibu:yoa1taC070UGJkP52CLo8DgibpS7ote
TLSH
T1C0B5F053FB8586E5C65D0536AF504285922EE931AA0F57523A8C031ECF53B8B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4868	39C3.tmp

Executes dropped EXE 1 IoCs

pid	Process
4868	39C3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39C3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4868	4148	2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\39C3.tmp
  "C:\Users\Admin\AppData\Local\Temp\39C3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe BE5E6BD13E5870F0A96A3687791F54E20FB512AF7D6789BA599FD4EE3C1119E4F9D72B4894836CC6315016D9DE83AAD47614ED8C7F00C4F45CD95847BF1774E8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\39C3.tmp
Size 2.3MB
SHA256 74a0f95c96621c0719915124e9ddf8fbe703dd6350c86df8735f1b378a3ee9a3
MD5 134c0b7775cbd9fd20f6aff464c61b2c
SHA1 390c452c1e556cf275c0266b091a1abe264730e5
SHA512 405ae7e29ac369a2db5a4751d97a2a4da2b8fec41ee281a51349db6d3d5bade60ab1a7df5b51efcdd4ca934398300267c0a609272c8562aa62d4bfe98c648758
SSDEEP 49152:yoa1taC070UTibyZnxy1ZZpRUbIlX98Ss89Koh:yoa1taC0AbyuzTKcKSs8Io
TLSH
T19DB5F053F78186E9C65D0536AF644281922AF5316A0F5B527A8C031ECF53B8B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download