82404753dc27beee3f7e12a5e012489d21adf56a8e88af14c8f2b073bd312b91

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_302f550ea60cc5f1ea169fc1922e786d_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260816-a4ervswgrd
SHA256 82404753dc27beee3f7e12a5e012489d21adf56a8e88af14c8f2b073bd312b91
MD5 302f550ea60cc5f1ea169fc1922e786d
SHA1 8e675b69d386ab9c6bf7ed3dc57b4f54197a905d
SHA512 80274dd73082dd522179511885def060300c2fe64da157afa4fb0d30c7f11cea6fa55f8138e7362dda0d8d27cc2751e347d11d0aafa80c8e04abae99f0ce3427
SSDEEP 24576:k2oo60HPdtz1CRiY2eOBvcj3u101wrB8z+G8K7Emk7OdiHzkq78gqK9zW39uTGxv:Roa1tBC0701OB0RIm+HzJQK9zWMqcyH
TLSH
T17F952314F761C2B6D4820675E582C3E299B93E7C5B458DC33FCA1B6F3AA0AC05A72717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3552	520E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3552	520E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_302f550ea60cc5f1ea169fc1922e786d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	520E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3552	4364	2026-08-15_302f550ea60cc5f1ea169fc1922e786d_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_302f550ea60cc5f1ea169fc1922e786d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_302f550ea60cc5f1ea169fc1922e786d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\520E.tmp
  "C:\Users\Admin\AppData\Local\Temp\520E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-15_302f550ea60cc5f1ea169fc1922e786d_amadey_elex_smoke-loader.exe 1B95F786379970E7F847D3CCFC84A801093AD6318F2D4F0CEC318DB44DEE98202F7652EB7D855F13E3490345337B562D053098D92F986E5C12D6CEF41331913F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

520E.tmp

Path C:\Users\Admin\AppData\Local\Temp\520E.tmp
Size 1.9MB
SHA256 3a0197cb1c7532a815e567e03fa73a49efca77dcaefd43054a6c3ab77fe741f6
MD5 b76392df18854d622e163dec2bffd3a1
SHA1 8c5d233d6f8666b540b0e081ca695b74d43b9ba4
SHA512 6d55564501e42228134f971aa241ca825651834517ee957bed9f66c96073b104f0bedf7aa736d046cf2f5f561f224347e7641ca5ef4d96a78f079b413de5efe6
SSDEEP 49152:Roa1tBC0701Mo2KZTWTdpT0miQxrk0AIMlCd:Roa1tBC0OZjiAxG
TLSH
T1AF952250E789D1B2C0420A71E692C7E2ED757E7D9A564C833FD85B7E2990EC02B32B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3552-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4364-0-0x0000000000400000-0x00000000005E6000-memory.dmp