0891f6087b1b8300775272973fe1ca6cd0a69d3cc8b512c2b96116a1886ba4b4

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_474e7b37cf6aaccfceadfb849affb536_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260816-azelasxtht
SHA256 0891f6087b1b8300775272973fe1ca6cd0a69d3cc8b512c2b96116a1886ba4b4
MD5 474e7b37cf6aaccfceadfb849affb536
SHA1 0d80f74f1995422c415ba004f2585d3559d3a235
SHA512 578213ed9e23ac69e4358deee27f36ab95221f50668b2bc0f1568c26706f25998c36f32833b5762cb0a63d50653f7f29bdde3ea14452bfeac98ddd703f0d8712
SSDEEP 49152:eoa1taC070UCsUaQHfukVVH8mejYVfxf:eoa1taC0UTfrVN8aVf
TLSH
T1E8952260F7D5C2B7C4820635F491C7ABD8A43D7C87459D877BCC1B2F29A0AC0AA72697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5028	768E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5028	768E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_474e7b37cf6aaccfceadfb849affb536_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	768E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 5028	4624	2026-08-15_474e7b37cf6aaccfceadfb849affb536_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_474e7b37cf6aaccfceadfb849affb536_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_474e7b37cf6aaccfceadfb849affb536_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\768E.tmp
  "C:\Users\Admin\AppData\Local\Temp\768E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-15_474e7b37cf6aaccfceadfb849affb536_amadey_elex_smoke-loader.exe F5AA644ED4CE556A38668CDF4DED721923AA10B66C1C3F94C711CDE894F0DE946E4C21AFE26C2241470B3C605D29610991D7F66F2DBA6E094B6F485C5943A00B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

768E.tmp

Path C:\Users\Admin\AppData\Local\Temp\768E.tmp
Size 1.9MB
SHA256 6a49c93968a368103e939b810ead0b446cb7914c8fe79172c9f605573a550fbf
MD5 a2e28e900cc44b22e6790ca5ac8f08f5
SHA1 e73c812cae7ce4c3d1777a1b7cf54e70462abc38
SHA512 ced9b8b1272398c2e79110df154c6cddd561e93b8316837b27f4d31e443be33f9ea975ed9d0300fd1b45884652723ac755cdd96cd5128ad6a8e86815e1fbb93d
SSDEEP 49152:eoa1taC070UXRKW80gaaG9ngdJaMrQZ263X1gXQ04v:eoa1taC0+W80ga/mazYe2Q0
TLSH
T111952261F384C2B2D0850635B652C7E7E8793E7C97018C837BD82B7F2964ED0AA61B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5028-6-0x0000000000400000-0x00000000005EB000-memory.dmp