7018d66a187b14800c85ef9d6ad3fdb8c03dbb374d9bc8b4e0e1d494ca5c9f57

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_33098513a0fa17eca1182d9744f04d6d_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260814-ydldqa1thx
SHA256 7018d66a187b14800c85ef9d6ad3fdb8c03dbb374d9bc8b4e0e1d494ca5c9f57
MD5 33098513a0fa17eca1182d9744f04d6d
SHA1 859df985b3dfb1342120bf44f3f829d8840868af
SHA512 ed3968644a867857eb0f9de9bca6fd3e3b2768e8b1d15279fbe9915323132dba0d3e1baa6849098354d3fd912dc3f101e2d1e0595755c3aafe99ef7f39264b68
SSDEEP 24576:82oo60HPdtR1CRiY2eOBvcj3u10Uku1HzDVd55EwaDZ5PmrGgG0WiyOMzhZTZXYE:Joa1tHC070UkuBzx5EHPmtW+MDncFGp
TLSH
T163951259F76881B2C081C57AE652CB67D4B2387993004DCB2BD58F6B1E27EC4B635B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3824	A06C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3824	A06C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_33098513a0fa17eca1182d9744f04d6d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A06C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 3824	4284	2026-08-14_33098513a0fa17eca1182d9744f04d6d_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-14_33098513a0fa17eca1182d9744f04d6d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_33098513a0fa17eca1182d9744f04d6d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\A06C.tmp
  "C:\Users\Admin\AppData\Local\Temp\A06C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-14_33098513a0fa17eca1182d9744f04d6d_amadey_elex_smoke-loader.exe B10EBA37B459140C02758C7F3661DE89590FBE253F0970689E8484AF58C4E6744A3CFC21CA8569584B63BC04FF79BB2CD30DE40C5C281952355EF54530BEE87B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A06C.tmp

Path C:\Users\Admin\AppData\Local\Temp\A06C.tmp
Size 2.0MB
SHA256 2b717041c0d75eabccca14dd2a15fdca06b4666b2c4f1d2e150e1397d4cc7c98
MD5 13d3bc837a8060046f7521cf9db09ee6
SHA1 5d451760e2d8d01e1bdf304280ec3e7cddd3749d
SHA512 b3c6fa17b825a41655e758f579803c603c0fb98ff1f1f24260a063232fb9459e27eadad209987f2b170b27fe9d65f2373b9005ddf9ec9b702cf04eab754df472
SSDEEP 49152:Joa1tHC070Uz4SJ0ZXAxgJ4ajaHwFEuHvWzOd2YyLG8bp2pvfp:Joa1tHC0VXqwxcRSiZuzOd2YyLFl
TLSH
T1B0951248F79881B6D042C9BBE1628B67C873387A57004DCB67948F6B1E27EC5B631B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3824-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4284-0-0x0000000000400000-0x00000000005E6000-memory.dmp