aae306ae82da18d50080db70c8a58ae7ed2251a5c74687f1abdadf1f8dcebc63

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260817-wqka3sfl21
SHA256 aae306ae82da18d50080db70c8a58ae7ed2251a5c74687f1abdadf1f8dcebc63
MD5 cb0e9e51b47fd9e941c5709269c18b72
SHA1 6acca7ad5f07841659b0aee9c759cd3d78f40566
SHA512 9d643bde101c4632eceef6aa159ecbd191612d067f492966dc6c7816278e957174fa46121a5aea2307f24dd76a5505a9d679d6040dd405c7d33e07c6cb6fa866
SSDEEP 98304:emhd1UryehcXkLwmQL4E1/lbV7wQqZUha5jtSyZIUS:elPLwnEE1tb2QbaZtlir
TLSH
T10C56BF05DBE8EF1EC91F03B590B2222657FAD894E783AFD6A951F5B07E82310BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4136	7286.tmp

Executes dropped EXE 1 IoCs

pid	Process
4136	7286.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7286.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4136	1104	2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\7286.tmp
  "C:\Users\Admin\AppData\Local\Temp\7286.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe ECC6D9A7E5B0B136E0BAF8A6896095587CA34449D72FDB53D26AF46E60C4867A504E0E7F1C060B3FFDCA57F8BFD8E6326C0B32A77A7A0CE3B4E59B8F1B6F5D8C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7286.tmp

Path C:\Users\Admin\AppData\Local\Temp\7286.tmp
Size 6.0MB
SHA256 bcfed8f6b58e46fe68cacd846afa5ccdaf1ccab9f17f1d1b5b81762ad7fba46a
MD5 d67bcefd714667a156c90298a6fceac3
SHA1 c493d07979563fd73022825df1c035fe162489cb
SHA512 1fe425a7feade3dbd72dd3d0accadc19308d7293cb10fc7a14f23421bbd67e62a2f6152281936e4b4e4ffa3ae72f884f73925fa0ceb6c82323381e8a1f6f75df
SSDEEP 98304:emhd1UryeqKgYcnV7wQqZUha5jtSyZIUS:elKKjcn2QbaZtlir
TLSH
T13956BF05EBE8EF1EC91F03B590B2222657FAD494D783AFD6A951F5B07E82350BE02153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4136-6-0x0000000000400000-0x0000000000849000-memory.dmp