c8b1fadd855fa434afdfb0571935eee4e45e532170b34a66891d3ab37385e706

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_7809f9cd0129f57a16fb8b14bd6d5249_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260817-s45bmatekf
SHA256 c8b1fadd855fa434afdfb0571935eee4e45e532170b34a66891d3ab37385e706
MD5 7809f9cd0129f57a16fb8b14bd6d5249
SHA1 eba8db2b33b1a8bdf7a9e4ab0185557da053960e
SHA512 3bf8c471e57d57178f71847d462da8694dd8781c2c6dfb2683437d5a0f54a15d7cc73d1ba045d3cd00c6cd3bdce1e41b0970158a73f0bfc4aaf1721aa75c7978
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d00kE+FGBbuofL2RlgkAaxV4z4NHtbHI8+oMW:Qoa1taC070ddk3F0uoolgktvbrI8y3bi
TLSH
T142952364F794C1B2E0C20971A552C7E3986A3E3C95858D873FCC1B6F2AA0FC06676B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3232	2215.tmp

Executes dropped EXE 1 IoCs

pid	Process
3232	2215.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_7809f9cd0129f57a16fb8b14bd6d5249_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2215.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 3232	4372	2026-08-17_7809f9cd0129f57a16fb8b14bd6d5249_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_7809f9cd0129f57a16fb8b14bd6d5249_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_7809f9cd0129f57a16fb8b14bd6d5249_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\2215.tmp
  "C:\Users\Admin\AppData\Local\Temp\2215.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-17_7809f9cd0129f57a16fb8b14bd6d5249_amadey_elex_smoke-loader.exe C3F227D7FE1440231B9B740E71D3EFD6FD038EB3783303F685CD1A0CAF191CE8964AF4DFBB46490764F7246F4E37C325A489529A522BB828E7B5FBB8657AE0D8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2215.tmp

Path C:\Users\Admin\AppData\Local\Temp\2215.tmp
Size 1.9MB
SHA256 284d79e9e8da0215bf43f8ca3167f02a7fbe8a32a993c29a1f916a68e4912161
MD5 d16ac77570e58d60dcb3f2fac36e8946
SHA1 d36444264c8f4fda6350fef876c4f0de07ea77e9
SHA512 1c33af7f7e924129b40bd780793bdb3f3edc949a7efcbe44bb9109df5de18abf177def525888218ae9cc0ed48ed21e4e0cdcd336c77ce46267c49b2b7ca29cc4
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d6DuqRedmT2TL4JXnC2jujF7u/5m+CqfVbzBH:Qoa1taC070dGu5mT234pV4i75nd
TLSH
T1D0952355F391C3B2C0920A71E192C7F6D8653E7A5B42DC83BBCC166F29A0EC46A72747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3232-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4372-0-0x0000000000400000-0x00000000005E6000-memory.dmp