480ee9db36150d578046eee80ad31f1bcc8e79d0024a873b451ba4f55c0d624a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260817-wydhhawfld
SHA256 480ee9db36150d578046eee80ad31f1bcc8e79d0024a873b451ba4f55c0d624a
MD5 b5a78f124b89c2a7f3e626af95b8ed26
SHA1 0f698b0747f0014f5548ad354a348d3791e60990
SHA512 f514f039f66f26e0fe35e56580a9dd46a58383b65e10cac8f3adf9222ff8216a335705e744d570aa4a715a2acc96e6a32c69de0ee563cdfafe406e89b7105f98
SSDEEP 98304:emhd1UryengrSqOz/77V7wQqZUha5jtSn:elHgr/Ozj72QbaZte
TLSH
T14F26D00995FCDA2CCC1F51F4A1A51145C7F4A524EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2604	6.tmp

Executes dropped EXE 1 IoCs

pid	Process
2604	6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2604	2868	2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\6.tmp
  "C:\Users\Admin\AppData\Local\Temp\6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe 15B768D4E89AABD478242F9D41CBAA3725259693C640CB6BC6186BE157AE9CF4E42277C5D1B4E45E0435BE4CFF631CF576E653BAF205BE7444A544AF4F88D7CF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6.tmp

Path C:\Users\Admin\AppData\Local\Temp\6.tmp
Size 4.4MB
SHA256 139f011926d4bda870369a3f520d0e49ab4c932138ec98131046536cbd40b7cc
MD5 e62efcaf760eabd7ed942bbf7004b7ac
SHA1 4c4426f56d5a3b754e5ab1d6e286a9abb8b954c6
SHA512 6833ec6c11babaec5b7c82bbd2c8a79fa56691055ec7c1c31b0817a6b3ed5d570ef285195716b28e6d1faccc8a7dcec2a542fed94821345656df475b3245f613
SSDEEP 98304:emhd1UryeCfCyOH5+yMzU5V7wQqZUha5jtSn:elifCyOHiY52QbaZte
TLSH
T18726C00996FCDA2CCC1F51F4A1A51145C7F0A564EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2604-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2868-0-0x0000000000400000-0x0000000000849000-memory.dmp