11f30c348279708260d05af1abddb4a9f85e310efe2ca60130c61d9e66858594

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 07:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_71a59caac52e5ec7677970452d841ee9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260814-jjs87afk5x
SHA256 11f30c348279708260d05af1abddb4a9f85e310efe2ca60130c61d9e66858594
MD5 71a59caac52e5ec7677970452d841ee9
SHA1 8d206baf7e5ea7e25f557485b8f9b945ff65e52e
SHA512 c2bc266df662767475bf7cd2c1e0a521c3bdb72f84c4e39d2b4e5bc1bd0cc7c65e5685b3492d9f9e1ace45b5d55091e1c64c28c7148327c26617928effe136f9
SSDEEP 49152:eoa1taC070UG5dLPijG3rIwhbjcN9gp+wjB:eoa1taC0ydLPijurdhbjcK
TLSH
T1E7952350F785C2F6C0910A71B592C7F698993EBC47418D877FCC266F29A4BC0AA32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2620	6315.tmp

Executes dropped EXE 1 IoCs

pid	Process
2620	6315.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_71a59caac52e5ec7677970452d841ee9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6315.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 2620	1240	2026-08-14_71a59caac52e5ec7677970452d841ee9_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-14_71a59caac52e5ec7677970452d841ee9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_71a59caac52e5ec7677970452d841ee9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\6315.tmp
  "C:\Users\Admin\AppData\Local\Temp\6315.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-14_71a59caac52e5ec7677970452d841ee9_amadey_elex_smoke-loader.exe FFAA64E4AE44AA05A01EBCD1C3A40981F1643A011B1088050764DF7D52AC0F34252A721E8891A395303B7E426ADB3039BEA09C4F438A1A83A0F5B1000956426F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6315.tmp

Path C:\Users\Admin\AppData\Local\Temp\6315.tmp
Size 1.9MB
SHA256 fea50d1f69d85d4290c8db3ec8f9cb0898aa0d17411da22eed417ef8361b4bb1
MD5 d6fe10e6cabc38e14f6fe534ec295ca5
SHA1 e68832c8081eda6a15cd66c94850c1a50b9a3f15
SHA512 8fc3040d701c156cebc5654c33ee489ffc0bf9c6ca2bb22b078f288e066bb13ebcf93e1d058b2ae6c650ad217aed4ea3d4c2b7fb0aa8b50c3212aefd627cf6fb
SSDEEP 49152:eoa1taC070UWJnE18aXmPQA4/fni8hG58OZoqw2kzBA:eoa1taC0cJn889PQAenBiZ
TLSH
T177952250FB95C2F2D0810970E691CBF1A9693D7C46458D877BDC1B6F2E60EC4AA72B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/2620-6-0x0000000000400000-0x00000000005EB000-memory.dmp