75c408c88a02a332e01237534bee211e209f175929db24107f08df39736940ad

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_7934fd2adcc2ad88ebff76eda1f07470_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260810-e9nzya1emg
SHA256 75c408c88a02a332e01237534bee211e209f175929db24107f08df39736940ad
MD5 7934fd2adcc2ad88ebff76eda1f07470
SHA1 af905ce8beab7be9b6e4e9545485790056f397ef
SHA512 1522c2537d665c1cae6863ab81366bf98c517a41edc210a4edf849ed43bfaa6ead1eca83cc465a8d2955c775fc40cc06ea8975621012c295014bf34ec6d511a5
SSDEEP 49152:Joa1tHC070UwioR9ntDiHBFkMgKvbd7p:Joa1tHC0+ioRvuHz2K
TLSH
T1FF951219F39881B6C042D57BE5628BA7C573387A57418DCB27958F3B1D2BAC4B234B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5320	5FCA.tmp

Executes dropped EXE 1 IoCs

pid	Process
5320	5FCA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_7934fd2adcc2ad88ebff76eda1f07470_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5FCA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 5320	2300	2026-08-10_7934fd2adcc2ad88ebff76eda1f07470_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-10_7934fd2adcc2ad88ebff76eda1f07470_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7934fd2adcc2ad88ebff76eda1f07470_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\5FCA.tmp
  "C:\Users\Admin\AppData\Local\Temp\5FCA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-10_7934fd2adcc2ad88ebff76eda1f07470_amadey_elex_smoke-loader.exe CC33BE1B70D64E8A67EB6AD7532D590FCADD55523881FC9552EEFE59FEF455BF06304072BBF2CE41225DA5521526BA05FA596C6CD1DB32EE34B6FBDB7A079B86
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5FCA.tmp

Path C:\Users\Admin\AppData\Local\Temp\5FCA.tmp
Size 2.0MB
SHA256 6804e28ff5ea8894eece419d86dda910c2b6ef1fca4b52859f9fb4c8a2ccd895
MD5 8b23e1cbbba4aa58d43a5d5affa8d56e
SHA1 a82a668d988a2a1618657eee6b9c08191c1a5bd0
SHA512 e16c36f20a1804fd96c040bca5386685473cb2696d97b74a3b3c11d2caf4eee715a2413770ab7084903b80371b86dda6ebd2e44d46a835fc39112c62ea09d216
SSDEEP 49152:Joa1tHC070UTxyWSm2WeDC0Km7ClPnmHw2tsb4RFcp:Joa1tHC0Wz1WOOlpahRF
TLSH
T16C951219F74480B6C041D97AEAA6CB63D473387A53048DCF67D48B2B2E67AC1B634B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2300-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5320-6-0x0000000000400000-0x00000000005E6000-memory.dmp