bfd44028a1fe7dca9d244a5ccc758d39c6f1c9b47bfa031477d11f5d8ec5080e

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260810-wpmd2shf76
SHA256 bfd44028a1fe7dca9d244a5ccc758d39c6f1c9b47bfa031477d11f5d8ec5080e
MD5 e7dcdf0cf566cf04025cd635da9ee703
SHA1 5eeca6f763e1be8ed4b2891f97e100f483c9ec39
SHA512 a34375c3519afee74b794f6bfe076b68fff2069d9a80f108eeaf952fa12355e65685bc37e36703c353538829471991e02a3338024bc6d1406eee23052546776b
SSDEEP 49152:foa1tqC070XU/FBkw2a6dn/0JTnlStd3s1S0NkvqlZ:foa1tqC0J/LpAnGnlSru4
TLSH
T158951250F7E581F5E0A75A319AB282A399B63D7857308ECB26C8466F2E32FC05D35713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3000	3500.tmp

Executes dropped EXE 1 IoCs

pid	Process
3000	3500.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3500.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 3000	3868	2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Local\Temp\3500.tmp
  "C:\Users\Admin\AppData\Local\Temp\3500.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe 1D301D76BD51BB2133301D589DCDAC3281E37595B7BFE864F2533E46A0DDF21AA5318E1B246646FE84E321B0A4BA9A466A14F733F68B3366DDA9CD777202F441
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3500.tmp

Path C:\Users\Admin\AppData\Local\Temp\3500.tmp
Size 2.0MB
SHA256 01a2cf3ba234c5952de4bc1c1fc2340653a8b3646eeb2fd8d531d1ca38de10ab
MD5 b8d135f513d991f9471f01f1c95f404d
SHA1 4a1f888323fcdd5e1eb1276c93535fe959513e02
SHA512 c06462a3ce77e1fa5277cfe647bf32e5f0d6b4ff5258654c30b7000c51c4c39760f284f9ce0bd2de90cda285719b5a5ffd426f3351992a4bae8146da4ff27318
SSDEEP 49152:foa1tqC070XrMFsDV3FVZhOyTusoKLHRgXRtGfrt8lZ:foa1tqC0CHlFVZXKYRARYfrt
TLSH
T18B951210B3E182B1E0A35670A9B282A69AB23C7C5735DECF67C8065E1F61FC09D76717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3000-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3868-0-0x0000000000400000-0x00000000005E6000-memory.dmp