1fb04b59133d02db9d697cb88c087d0d84a75824c5985d95747fd2f924c39120

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260809-ydpfdavbqa
SHA256 1fb04b59133d02db9d697cb88c087d0d84a75824c5985d95747fd2f924c39120
MD5 99e7ccd0ae31a39cd04e84d130551ec8
SHA1 77ecfa4bb5bae773f847528b9da05e281f5608da
SHA512 452d24ea0fe65b00bb8f40ece776bb8a722ad17aa4a2c7c3fece90d7fa5b3a886e76b28275d5738dfd9783f8bcf9d518396f15d2847640e746fd5d3b44bd5f00
SSDEEP 24576:I2oo60HPdtf1CRiY2eOBvcj3u10siD1rACdQz1NZe2CWnj6goHcBSpxRr9e3srpu:toa1tNC070siD9TdiZZnjRer9isN8We
TLSH
T1FB952361FB91C2F5C0950671A661C2E39C796EBC8640CC83BBC91B7F6DA0EC06A35757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
832	C402.tmp

Executes dropped EXE 1 IoCs

pid	Process
832	C402.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C402.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 832	3528	2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\C402.tmp
  "C:\Users\Admin\AppData\Local\Temp\C402.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe 68CFDA52EFEDA5AFE2511F58321835062699EE0FD7E498A4B140F2695D3500DEAF525B108971FDD650A71BE145068B47613C90DB5F6D4629CEC230DFFF57E18C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C402.tmp

Path C:\Users\Admin\AppData\Local\Temp\C402.tmp
Size 1.9MB
SHA256 247ffd5fbf0c4220c908fd7ac26907a4aa5fdf38aa56aff5d1e97f22c72fd2ff
MD5 2dbb86d4f74c5d617c8352b27f253e7a
SHA1 ee5807e004ca0416de1c0c043d6a141445b6f44a
SHA512 9e8eb9cb8971c94c074082bbfca22dcae76fa56737a11343c33e56956764da34cffce942762044f1040b25da5024f9ebd0cd580855954a412832c477e2f69bf0
SSDEEP 49152:toa1tNC070sJ2CFaYTAYEY+2Qk+LRNnX9AN9sRVd:toa1tNC0tFaYTAYEYRQkONnX9Afid
TLSH
T161952360F6D9C2B1D4824671B541C7E2ECA93D3C46968D837BD92B3F2DA4EC06A32717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/832-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3528-0-0x0000000000400000-0x00000000005E6000-memory.dmp