8f9f5da9092a53cd6a3851424fcae0fb081cb319557b343b7e8ae985cea1b384

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_847e87449a9002c9dbd17a9c72fd63ec_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260816-3epvrazsfs
SHA256 8f9f5da9092a53cd6a3851424fcae0fb081cb319557b343b7e8ae985cea1b384
MD5 847e87449a9002c9dbd17a9c72fd63ec
SHA1 2f9e4797a1cc0a1c4d0d0643ef2157b4f1da46e0
SHA512 c4f4aee6ca187fa890e5305b0925359dce342aac58ddf8524a2173952e4ffa9c3809e41cd2744c06dcda00843fd5b932dd2fbba99000c66c6b5e8ea7a1dd1419
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d4XmdJgKfMdaPR4lNmoHoe5r0gFCYwbQ2OAc9:Qoa1taC070d4XmdJAdfplJQH3c0lJtc7
TLSH
T16A952254F7D4C1F2C0820A71E551C3E7E86A2E7D47069D87BFC8266F6960EC46A36B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2272	6B62.tmp

Executes dropped EXE 1 IoCs

pid	Process
2272	6B62.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_847e87449a9002c9dbd17a9c72fd63ec_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6B62.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5204 wrote to memory of 2272	5204	2026-08-16_847e87449a9002c9dbd17a9c72fd63ec_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_847e87449a9002c9dbd17a9c72fd63ec_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_847e87449a9002c9dbd17a9c72fd63ec_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5204
- C:\Users\Admin\AppData\Local\Temp\6B62.tmp
  "C:\Users\Admin\AppData\Local\Temp\6B62.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-16_847e87449a9002c9dbd17a9c72fd63ec_amadey_elex_smoke-loader.exe 0F81073095D131BAC3CA0BB81DEE4008C52624F20A30C5A5633EDFF416369AC13032AC8DE41ED336A9E4E67584B3E38F40B20CDA36FEDDBCCFA192057B317179
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6B62.tmp

Path C:\Users\Admin\AppData\Local\Temp\6B62.tmp
Size 1.9MB
SHA256 b050e27ee19e78c4f71de68e06fceb944dc1b3f432e3ad091c04fdad2f896bad
MD5 71ccee906d8d1e942e2c8745b088cb33
SHA1 77a7e9def6c26fa50c8133537b7349fb7ac2cfa2
SHA512 17b764cb51f132e5abe799614d40982e6f6f032d2e5f7b56aaeeb09952c109f33b6e915e1021c468cf6e76ba5f58e03f66aa3c0d7dd8f00b82c934e7d734ce4c
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10de1uo5oQM5VNJ78RiYKlXBAEprfbXhNCmOfKg:Qoa1taC070dOoFLORiYKL3RobfU2f0Po
TLSH
T1BD952211F791C2B2D0820971E662CBE2DC793E798B459D837BC81B2F2CA4EC05A75B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2272-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5204-0-0x0000000000400000-0x00000000005E6000-memory.dmp