61dbdfbfe9f9d0427ee74310990bff7796893b672d7aaf4772e30cb8e07c34c3

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_a3e4fab87837fd9bf677127760e014f2_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260811-ws2cdayapb
SHA256 61dbdfbfe9f9d0427ee74310990bff7796893b672d7aaf4772e30cb8e07c34c3
MD5 a3e4fab87837fd9bf677127760e014f2
SHA1 4e0b7ace5a27359ea54dcbac91a55c7f08693453
SHA512 e4bde1a1f8d1706b8587dcd876e09a4c1af54573fd5ecc7074d37c865cd33df019edc63a30a15a410f9576ae425c1c36aa6fb0cfe88b22bb62425d396b9a3956
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10djsuzbDOR7h+J1hrmF/OzNLnAZFWCPrWXG22r:Qoa1taC070djsuno7Knr1LAZdO2z9/h
TLSH
T1E9952260F790C2F2C0950A7175D2C3E6ED763E795A428C477BC81B6F2864EC06A72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5228	BF7E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5228	BF7E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_a3e4fab87837fd9bf677127760e014f2_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BF7E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 5228	5192	2026-08-11_a3e4fab87837fd9bf677127760e014f2_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-11_a3e4fab87837fd9bf677127760e014f2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_a3e4fab87837fd9bf677127760e014f2_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Users\Admin\AppData\Local\Temp\BF7E.tmp
  "C:\Users\Admin\AppData\Local\Temp\BF7E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-11_a3e4fab87837fd9bf677127760e014f2_amadey_elex_smoke-loader.exe 9BD51B238191026F3EED89732B227962C0D9649B4F355F5202D16237A29EA37F84C55C7C27065690A0B2F3ED9FCE4CC41EDC6BEF0EE1B73DC63F12D2065D1BFF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BF7E.tmp

Path C:\Users\Admin\AppData\Local\Temp\BF7E.tmp
Size 1.9MB
SHA256 198f288d847b89f5f17a0559265d76f30ae99382495bf65d2d93c4e06ef78182
MD5 6efded275be23ada3339f2b1624f559c
SHA1 90b6b8375804bd8919fb836e589715c6d65be235
SHA512 588cb53304d67d68d547a9ec3c81f3cb8f623dad075055e84db52e18e70233b4e6a793581abf599b65235effb3ca7b08407e6dd30876c52bbf4107b1ba4354ed
SSDEEP 49152:Qoa1taC070dDlq+oh2y/hF0dBDwO5TF30G3Z:Qoa1taC0olRohbZF0Lh2CZ
TLSH
T141952250F685C2B2D0D20571A951C3E3E8793EBD96958D83BFCC1A7F2860EC0AA71797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5192-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5228-6-0x0000000000400000-0x00000000005E6000-memory.dmp