595a0e1f86da2dadada241bd95956a6ccf9f28e63a7adc0a87ba6ae7fbaede7d

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_876c4b77aa77720fd83b681cd412f6a5_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260810-14ttwszdnd
SHA256 595a0e1f86da2dadada241bd95956a6ccf9f28e63a7adc0a87ba6ae7fbaede7d
MD5 876c4b77aa77720fd83b681cd412f6a5
SHA1 815f3f2d69d7d035054513584f24ec108fce6a46
SHA512 06406d37651b22fc198b8a2f7453cf380360fe10f9203936e310ace3a3f1607d24e02d847e3b7285e1fb5b94f3eb890f443a5b3280baf363495befbdf01b299e
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dCFgRkTEnKTxWk7wxMZ6xdmfqTNOGBJdLCoR/:Qoa1taC070dT6EKc2wKZaouvj7Zh9
TLSH
T149952214FBC5C1F2D0811671A2A1C3E3D9653E7D6B858D83BBC9276F2DA0EC05A62B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1696	5049.tmp

Executes dropped EXE 1 IoCs

pid	Process
1696	5049.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_876c4b77aa77720fd83b681cd412f6a5_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5049.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1696	4064	2026-08-10_876c4b77aa77720fd83b681cd412f6a5_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_876c4b77aa77720fd83b681cd412f6a5_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_876c4b77aa77720fd83b681cd412f6a5_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\5049.tmp
  "C:\Users\Admin\AppData\Local\Temp\5049.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-10_876c4b77aa77720fd83b681cd412f6a5_amadey_elex_smoke-loader.exe 035CEBBC14E417F153C35AF8DA986DA1ECE018DCF6000228187003637D54A3915BC90EFFD1BCE5C0C929DBE62761DD0B2881F8AC38DEFAA601753061F358188F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5049.tmp

Path C:\Users\Admin\AppData\Local\Temp\5049.tmp
Size 1.9MB
SHA256 ffc87fe73fa2e734b1a5b8a4fb9b468155b590247d371eaeaf843edc6da37471
MD5 a5a79d3417ffa3c372b388d6c6c909de
SHA1 809f6dd6ca197c7520d8d5e5b00a2dfaaa798c00
SHA512 3313672934663cd4e3f6e21604fdd610023a04004e6e934f1313457abb7909ff2979996fc4eb62c9b32b6b0b25c66a6a0a1e71f0c7791e778db1998ca8209218
SSDEEP 49152:Qoa1taC070dWaTzs/oblVMSpwjOyZxkdrYmsFB/:Qoa1taC0TaTTbLg3ZxkdkmY
TLSH
T1B2952260F795D1F2D4810972E192C3F3E8A93E7857418D837FCA1B3F19A4AC05A62B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1696-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4064-0-0x0000000000400000-0x00000000005E6000-memory.dmp