9f19410379906ed109a214b195d705cd5e1c0b97dfb3c557571551449db87812

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260810-vpdapsdn8z
SHA256 9f19410379906ed109a214b195d705cd5e1c0b97dfb3c557571551449db87812
MD5 b8290ff150411dcabdb0d7945b60f0ce
SHA1 24bb94b3e82c9bde98cadb2bf11a8b97b278dc05
SHA512 bf9b47630b197ce07bb191d42bb845fd6e8b27370e8be775c96d966ffaccba385cecade23d84b770af511de8dd22c8800d851b1dcae15a2bf0ee70ff3958d7dd
SSDEEP 49152:Qoa1taC070duktvmzbjpdkOPV7ScuBU+DT:Qoa1taC0QtYn7ScuBU6
TLSH
T1FE952215F7C5C2B2C0910670A691C3A7A87A3E7C87469D837FC81B7F6D90ED0ABA5607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1768	75A3.tmp

Executes dropped EXE 1 IoCs

pid	Process
1768	75A3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75A3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1768	2484	2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\75A3.tmp
  "C:\Users\Admin\AppData\Local\Temp\75A3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe 147C0423B21F43C41A08D28C4181C088859A906F1B41D2012D792F1677A02B19EFCF0FBAC4209BC32860F0D1DA38B9A6F1341AE09E1313EBD793AE7587E36BC6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\75A3.tmp
Size 1.9MB
SHA256 4b877326f819fa3ef161ed86a6dbdf090ce1c6b2c581ebf99d91cc9a3e35ba01
MD5 e3a344df12c30afda2cd4ea0445d5a0a
SHA1 34659ae817689dac4a4e2767f3bd39d32e692a97
SHA512 0814ae0bcfc723d17a73ca83af62248746ca22968c8ba9fefa29ae5a338203011da471ce4c191169c67aa325b99862eedad3ce321a6ad9ac9b16fe1a763dee17
SSDEEP 49152:Qoa1taC070dNajclUGoPbfM7I5fl6T8EiIrAGSKs:Qoa1taC0UcO6TfM7ykT8crACs
TLSH
T11C952250F6A1C2F2D4810A71A26287E69C393E7E53429D873BCC5B3F2D60EC06A76757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2484-0-0x0000000000400000-0x00000000005E6000-memory.dmp