5e73bc6578e6dc65e4e0241ee8c28afa0d344a6a706229689ca1d03f1a53a9e2

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260809-vceb8sam2t
SHA256 5e73bc6578e6dc65e4e0241ee8c28afa0d344a6a706229689ca1d03f1a53a9e2
MD5 53067a53d93ea325a2294281869cf9fb
SHA1 710fe53a112c8151b6f8c4bd18b09f122f4d4167
SHA512 10374fd4c710cbc3c2ad1ce8a0273e9705f23547d36c442247bad0e79ac8a2de8fc827d6dcfd8aa673f7f64c79d973b4c9c1aa749353ac998a4b7415aa1a54fd
SSDEEP 49152:4oa1tKC070EOs8uRS5M/kAD5sHZlTBQub:4oa1tKC0oz4SwkO5s5JBjb
TLSH
T11A952255F7C5C2B2C4910A70B562C3E698393EB956828D47BBCC1F3F69A0AC07672B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1200	F72C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1200	F72C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F72C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 1200	4132	2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\F72C.tmp
  "C:\Users\Admin\AppData\Local\Temp\F72C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe 132FA3AAAF1078E2B5A0D32A40CEB09DF305747D0A5F8D9F49CE60CA557072EB62B0FA01AB18A7799B8F19B71EC495ED4750D2E1FDAB8FCEBA6F39D116B58B1E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F72C.tmp

Path C:\Users\Admin\AppData\Local\Temp\F72C.tmp
Size 1.9MB
SHA256 ed5a0575ce8276a93270df248bdff2eea0b8eba8edf664b489ff0fc51e904eaa
MD5 736d0dc9393e9db9993642ee43ea3930
SHA1 008c36dacf995e0ecad164fdd13d89c797515da8
SHA512 530ffc271e4922c31378abadb50f9d0060ad76f46bc4e6bf16f87ee31b61772fdbbd5307beb81c2c1c12831ecf963f5d769dca5cbb8cf6b9a19f3df01528d421
SSDEEP 24576:12oo60HPdtu1CRiY2eOBvcj3u10Eiq2GkaZLcxTMiCFUDr/k9lCVBcv449ZaM40T:4oa1tKC070Ernky05CeK9Za0DX
TLSH
T180952211FB95C2B2D4960672A592C7E79C763D7D5B418C837FC82AAF2CA0FC05A32617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4132-0-0x0000000000400000-0x00000000005E6000-memory.dmp