08145937b9c5cc90bc0118fa615d7aa8a8a35603c37a44aa8d49d312a68f7f76

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 05:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_2454f69716882faf9bab8a2c1fac5683_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260813-f5syrsserc
SHA256 08145937b9c5cc90bc0118fa615d7aa8a8a35603c37a44aa8d49d312a68f7f76
MD5 2454f69716882faf9bab8a2c1fac5683
SHA1 27edd46ffc0a6913240a67da96c0674da904ef94
SHA512 27e634ea8373f0335f5f3e276883d23e75bf9f54b03f720382af2269e427931ed0c0580099ab967ad4e4affcf2edd5ba9c45e3aa1fe4da73a4f22ea8b74da6ba
SSDEEP 24576:P2oo60HPdt+1CRiY2eOBvcj3u10Ud1gVepyPfeR1WOSiLmv/VFi5Axh7jKypmDzL:eoa1taC070Ud1gmyHeZnja/jPpmAu
TLSH
T145952251F780C2B6C09106B1A56287EBDC797D7C96465D837FD82B2F2CB0EC05B62A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3684	1023.tmp

Executes dropped EXE 1 IoCs

pid	Process
3684	1023.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_2454f69716882faf9bab8a2c1fac5683_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1023.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 3684	900	2026-08-13_2454f69716882faf9bab8a2c1fac5683_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-13_2454f69716882faf9bab8a2c1fac5683_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_2454f69716882faf9bab8a2c1fac5683_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\1023.tmp
  "C:\Users\Admin\AppData\Local\Temp\1023.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-13_2454f69716882faf9bab8a2c1fac5683_amadey_elex_smoke-loader.exe C318817C35D985632B83F608293B1F271F31BAC6FED1480865F58BBA74AFC25AED91F9F63728CA20DDFDE7A412EC074CA917F601F07A0BDE1E56AF2F741E29B4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1023.tmp

Path C:\Users\Admin\AppData\Local\Temp\1023.tmp
Size 1.9MB
SHA256 3433b32db013fe65a1a94958dfa97462b6edb3e4518de9c013d5cc912e5427af
MD5 8f5b59a7f3d0e1c6932ab54c73dea2cb
SHA1 6898bca956c75bab2af59152a89d9e54d3c32dc6
SHA512 05ab66853ec52346f9a9c47e7f2783b6b159cbe8e0db9b6ca5c3838e7b50eb33d9dd1ba594267f3e5f0dff27c51d00cf14e2be9d2f0e045af46f5e4d988b1696
SSDEEP 49152:eoa1taC070UouOthBraGo/quqAhBHlPgZlLH:eoa1taC0AnuqAhBHlPG
TLSH
T110952260F695C2B2D08109B0A692C7A298B63D7C57559D837FCD0A3F2DB0EC06E7179B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3684-6-0x0000000000400000-0x00000000005EB000-memory.dmp