f89dcd09cf281ff7ab4a90586cf139db63b45b86ffb7fccb862888490c8dc915

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_05832a10730d4797d355cf1b65e62545_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260816-bdbsysar5s
SHA256 f89dcd09cf281ff7ab4a90586cf139db63b45b86ffb7fccb862888490c8dc915
MD5 05832a10730d4797d355cf1b65e62545
SHA1 c90881300213052ca39d7f2b5e5f28f58a0860f5
SHA512 2a38b5b73a1008275de545a3e684e1e983f3fb7a91ac9e3540017ddb71b51c711cd4d1901851640e27394c32232abece6930379ca169044b6346af23a3df1f22
SSDEEP 98304:emhd1UryeKj/L90/23XskYV7wQqZUha5jtSyZIUS:elqj/K+3XskY2QbaZtlir
TLSH
T1B956BF05DBE8EF1EC91F03B590B2222657FAD494E783EBD6A951F5B07E82310BD42163
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3156	20AD.tmp

Executes dropped EXE 1 IoCs

pid	Process
3156	20AD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_05832a10730d4797d355cf1b65e62545_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20AD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 3156	3624	2026-08-15_05832a10730d4797d355cf1b65e62545_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_05832a10730d4797d355cf1b65e62545_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_05832a10730d4797d355cf1b65e62545_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\20AD.tmp
  "C:\Users\Admin\AppData\Local\Temp\20AD.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-15_05832a10730d4797d355cf1b65e62545_amadey_elex_smoke-loader.exe CE16619FD8777127A3CEF39E54B3E40EB589F6ACE822143E19A2B306809FBAFC94636E651A24279C227FBF9B985684DD7E736726B46B4AA8DAA8D83089BE473C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20AD.tmp

Path C:\Users\Admin\AppData\Local\Temp\20AD.tmp
Size 6.0MB
SHA256 3cfde1e4df1462e2d1cfc6b03d131ccef21a77bc38027ec8ef9e68c13b17a42f
MD5 f361a2aa6d209fc51a91746e0ed47287
SHA1 7d08e47c267c7ce0ea5878a486cad9e916d57a00
SHA512 e4759bfb676463edd4a31c0e75ed928c2aeb32e6bb0f6f1239790247b112d7552271ec20328e47519097808546aa915af5a7612e963aa161c941ff88252d77c5
SSDEEP 98304:emhd1UryeQSlEQ9zpYO1cg8sV7wQqZUha5jtSyZIUS:elnlEQ9qhg8s2QbaZtlir
TLSH
T1B556BF05DBE8EF1EC91F03B590B2222657FAD894E783AFD6A951F5B07E82310BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3156-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3624-0-0x0000000000400000-0x0000000000849000-memory.dmp