7db5449c8f291b7280079af56f25bd30ccd73e14a9313d67cb2675dd1eacf455

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_f51216973d41cac74b3334d330058076_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260816-c5cd8sybkc
SHA256 7db5449c8f291b7280079af56f25bd30ccd73e14a9313d67cb2675dd1eacf455
MD5 f51216973d41cac74b3334d330058076
SHA1 1ee5744a6da087a0ae35321ae6240125f9f4888d
SHA512 9152b1e3366619393f0cdb2f3baa56d3ea668a140ab11b61a3faa513dc06b02ea6060216d0593fa6c587d4610c6017299311677166d0bf0a8b27e976041bc280
SSDEEP 98304:emhd1Uryewq0rpf+B7vy1YyVLUjH5oxFbxCVLUjH5oxFbx:elQ5ev6tVUjZEdCVUjZEd
TLSH
T159262380F7E4C265D1C234FD658383DAD5343F2C4665D94B6FCE2A2EDCA89E27678242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4412	799B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	799B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_f51216973d41cac74b3334d330058076_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4412	4588	2026-08-15_f51216973d41cac74b3334d330058076_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_f51216973d41cac74b3334d330058076_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f51216973d41cac74b3334d330058076_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Users\Admin\AppData\Local\Temp\799B.tmp
  "C:\Users\Admin\AppData\Local\Temp\799B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-15_f51216973d41cac74b3334d330058076_amadey_elex_smoke-loader.exe 73D01DF16A91F225149D77A2E6C6DED0871CEEB9472DCDE236BDCDD7EAE6D4F36914205AC197CEB00C771489132335FA853E7D97528BC8BC22801F29ED2215E5
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

799B.tmp

Path C:\Users\Admin\AppData\Local\Temp\799B.tmp
Size 4.2MB
SHA256 f65759c8989bf47ce16bdca69fd15514a2c7f64473f76180121d26a1a39a6084
MD5 78143983e64ffd3d13fb1dbd37399365
SHA1 a98b015cea420615ea5b23e8fabc3402e06ddcc6
SHA512 bdd20edaa6b51433f65b9d2bf7fa01631a87bd22f92667e1e70e4d55aac6e29e5fb5fa7a21c8fc60c86720144c3c6e5574a86cce88899c0f4e9a41449c141a66
SSDEEP 98304:emhd1UryeFxwx7nVZ8l0DyJVLUjH5oxFbxCVLUjH5oxFbx:ellgVel0DyJVUjZEdCVUjZEd
TLSH
T125262390B7D4C261C1C274F9A09343DEDA353F7D557A954B6FCE2A2DEC688E23278242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4412-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4588-0-0x0000000000400000-0x0000000000849000-memory.dmp