ffc96283e1ae2a404d1e913f2fd7c410c55518bad1ce466785f565a29e6eeeb7

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_94d4d1c1750490109289b3b7c2ad1118_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260811-c8bl4sca59
SHA256 ffc96283e1ae2a404d1e913f2fd7c410c55518bad1ce466785f565a29e6eeeb7
MD5 94d4d1c1750490109289b3b7c2ad1118
SHA1 ded3c2f40521d2df81cf2464df7431786a3014d8
SHA512 bed84356447eab58f0e2f51454882dd32c829e1b352985321e1dbe604cfd611a74243de9a92cd4efe4cd7abddcbfc788eec7a1ffeb8b15255b16466695df6510
SSDEEP 49152:Joa1tHC070UKPRpZWe6QSaYIY6RE/w3FEiBNT1f6p:Joa1tHC0GhWnQSVIhyaFEiBT
TLSH
T161951209F7A481B2D050D5BAE5A28BA7D433387953004DCB2BE19F7B1E23AC57735B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
808	452D.tmp

Executes dropped EXE 1 IoCs

pid	Process
808	452D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_94d4d1c1750490109289b3b7c2ad1118_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	452D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 808	4416	2026-08-11_94d4d1c1750490109289b3b7c2ad1118_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_94d4d1c1750490109289b3b7c2ad1118_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_94d4d1c1750490109289b3b7c2ad1118_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Users\Admin\AppData\Local\Temp\452D.tmp
  "C:\Users\Admin\AppData\Local\Temp\452D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-11_94d4d1c1750490109289b3b7c2ad1118_amadey_elex_smoke-loader.exe ED8524BB576CB3C220AC3E13922D806B18C61BFA9CB7F4C5D3F0079F4EDFC5833E1F9A1CCBDAAE39BC61F0FE482B7E2C0666D70D219FE8B7B39B3AC3B66E2F33
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

452D.tmp

Path C:\Users\Admin\AppData\Local\Temp\452D.tmp
Size 2.0MB
SHA256 b206829650bbccdb996c54b32bc7a6df8f3cb8b3ba998e65ef5131cffc89428e
MD5 69f465f39d198a00cfd7fe1cda05a7c5
SHA1 3356f012c432d06ae59cae96273bd3889fa0880a
SHA512 47f87fd89b1d16b25ac757dc65661c6fcb8a1d2d1c1100eea1625ad657170fa43bdcc5b41338dcf20004896129edc5d89f92f97d78a744ba7af14bf14878f6c3
SSDEEP 49152:Joa1tHC070U0bLrnRt8vbKvKrQ/RFJA6mzZnDjD+p:Joa1tHC0ubLjRt8vbKSrQZFJBmzdDn
TLSH
T16D951218FB9481B2C08188BBE5A2DB67D577387953004DCB57E58F7A2D27EC4B230B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4416-0-0x0000000000400000-0x00000000005E6000-memory.dmp