4beb94e23668ba97d4ec21aca7099c3d1dc37068b40b9d4c5df9efa7b299da62

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_1affe092e1831094cad11c6ce1bf227e_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260811-vssjsst1d1
SHA256 4beb94e23668ba97d4ec21aca7099c3d1dc37068b40b9d4c5df9efa7b299da62
MD5 1affe092e1831094cad11c6ce1bf227e
SHA1 4195f7128636c3e530c9db80ccae91b90161f4ec
SHA512 66bc53424541ed168442f4922ce903c3aa20187ba71cb846f8c6e76de7d686f764ecd6023d6044e985c7335a956f29325455dccff1371513b1102957a943e94e
SSDEEP 24576:S2oo60HPdt+1CRiY2eOBvcj3u10UOMGQDLsM9k5I8Za/gd7E9cEUjdqMl9HkE7wk:boa1taC070UcQLsMSx4omAj9HdlemT1
TLSH
T15E952350F794C1B1D0810535E662CBA6DC76BDB89A554D83BFC91B2F1CA0FC0AA36B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3648	8812.tmp

Executes dropped EXE 1 IoCs

pid	Process
3648	8812.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_1affe092e1831094cad11c6ce1bf227e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8812.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3648	1236	2026-08-11_1affe092e1831094cad11c6ce1bf227e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_1affe092e1831094cad11c6ce1bf227e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1affe092e1831094cad11c6ce1bf227e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\8812.tmp
  "C:\Users\Admin\AppData\Local\Temp\8812.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-11_1affe092e1831094cad11c6ce1bf227e_amadey_elex_smoke-loader.exe A3D79E6D81725A127177B4C6C14B75E1D4CA0F61D74EC7E1ADD3F8BB0CB8D8B570D2D78123BC7B55B37A2F348A11EFA65C4003A7313CBF35C5511148AB62554C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8812.tmp

Path C:\Users\Admin\AppData\Local\Temp\8812.tmp
Size 1.9MB
SHA256 dc414e2d0ac8be38adf484bdb6cd9c3485c975257b3ce401e361bd315e348b5c
MD5 bc583eb6e2f5ea84a9fb3f7a558af50d
SHA1 ad2e432dd0565bc065c64711108c33f907e71189
SHA512 1cd44b7ca73845f9bbdd5440c96a9c45d58f4f11a4cfe29f2f78af1a1b2ebe64098fa71cc7e631d3c0d00ba24bcf7cb4998aa891b8d1e60df70a064b8c0a5110
SSDEEP 49152:boa1taC070UO1sdYK6D1I8pWJxYNq3tlq/xDau:boa1taC0c1rLarYA3tlYeu
TLSH
T109952210E794C2B5D08609B0A691C3F6D8B83E7D86429DC76BC81B7F3990EC42776B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3648-6-0x0000000000400000-0x00000000005EB000-memory.dmp