8a353ec22f059d4ccd9300dae8639a34e6dc02db4474f4c0b2826bcc31e7e692

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_8dcfbe6ca7f11edce728d544dcd0de93_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260811-c95atatfqa
SHA256 8a353ec22f059d4ccd9300dae8639a34e6dc02db4474f4c0b2826bcc31e7e692
MD5 8dcfbe6ca7f11edce728d544dcd0de93
SHA1 6fda974e6a6a9d9c38f596f01ddd32947a1d86db
SHA512 6265fe8026cbcf4e76aed56e2d2bcbfc27ee395611344a017f59de6e41e5a3de7e59ac19e7d2dbd3edd5d8bd053b0046e6adab4a6a7122115a13986cfb7883ad
SSDEEP 98304:emhd1UryeOLBMrejSh6DXn78i0LV7wQqZUha5jtV:eli/X78tL2QbaZtV
TLSH
T1B326C00996FCD92DCC2F52F4A1641185C7F0A564EBD3AF997DA2F1F029823A4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6024	816B.tmp

Executes dropped EXE 1 IoCs

pid	Process
6024	816B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_8dcfbe6ca7f11edce728d544dcd0de93_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	816B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 6024	3140	2026-08-11_8dcfbe6ca7f11edce728d544dcd0de93_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_8dcfbe6ca7f11edce728d544dcd0de93_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_8dcfbe6ca7f11edce728d544dcd0de93_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\816B.tmp
  "C:\Users\Admin\AppData\Local\Temp\816B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-11_8dcfbe6ca7f11edce728d544dcd0de93_amadey_elex_smoke-loader.exe 8B65F3E1C507E087D62B99F8AE84070B13F6D47B0CD9F9377254E19C65E0CD52B007B6B5749701C0CBF8550B5123BF54FE036275661DB8AFE2A6FD7890312958
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

816B.tmp

Path C:\Users\Admin\AppData\Local\Temp\816B.tmp
Size 4.2MB
SHA256 08830445ab2e8aaf1f5d0b1341a28d250925f4e5f097aac48503bc74cf6e1431
MD5 653ebb288d9c4fdc308ed0ba6ce33e56
SHA1 8f49142f5f8ccaac24f639fe83963c995a9f62d1
SHA512 abedcfa9ece670bea31e8c895a97de31002ad363b513b16a205b8127c2dd74004914914beaac11cfbadf03e42396e319289751b17535f8750674eae258451c22
SSDEEP 98304:emhd1UryeODr0y8XdrwrrEqt3qvV7wQqZUha5jtV:elemdry7x22QbaZtV
TLSH
T1AD26D00896FCD92DD81F52F4A1641185C7F4A564EBD3AF997DA2F1F03A823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3140-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6024-6-0x0000000000400000-0x0000000000849000-memory.dmp