65fe09b9a073ca0b3db427fae0f40e0db619f7216f141ef3935a53e37d370022

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_9c31a94271988833e6e3d0d3ac45a4c3_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260818-29txhsbh79
SHA256 65fe09b9a073ca0b3db427fae0f40e0db619f7216f141ef3935a53e37d370022
MD5 9c31a94271988833e6e3d0d3ac45a4c3
SHA1 dc01a5050c8b7d0ac275899de7ed4df941eb91be
SHA512 94cc496c734c0803f5afdc53f6f540221bd71272f5524d231ae2f964580d017b725da1a0d7210be4cd8be6bb74dadae5ddd6d10255e04f12ae20ec21d779a366
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d+wfjD4Kh8bc5p9OYfTNx1IYO2gtCD7CSViTx:Qoa1taC070dB34Khv1u2gu7ziFJN
TLSH
T101952210FB95C2B2C0911A71E291C3B2D9753EB993055D873BCC1B6F2D64EC0AA76B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2720	5980.tmp

Executes dropped EXE 1 IoCs

pid	Process
2720	5980.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_9c31a94271988833e6e3d0d3ac45a4c3_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5980.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 2720	3504	2026-08-18_9c31a94271988833e6e3d0d3ac45a4c3_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_9c31a94271988833e6e3d0d3ac45a4c3_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_9c31a94271988833e6e3d0d3ac45a4c3_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\5980.tmp
  "C:\Users\Admin\AppData\Local\Temp\5980.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-18_9c31a94271988833e6e3d0d3ac45a4c3_amadey_elex_smoke-loader.exe 4CA9E4D7237D3F0B794B0BBEE2BAB43E9036EC64F7D264433421699A159D217C5F56BCCD8AE377C29173C570574A193384FB5205A62A20C9F32E1916947DCDEB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5980.tmp

Path C:\Users\Admin\AppData\Local\Temp\5980.tmp
Size 1.9MB
SHA256 3d286247075ac330c66706226851f4c10ec2f31aab435cc245cacd7a629c0051
MD5 f27672f16b62a1dd59b8918a756712f3
SHA1 6e750ece9f9f7b29bf5f96b92a6dc938b5a65350
SHA512 93293f2a85cd090de606d0ed929340a3d626e8a1b26d85784a5c0d2a624a04c2adc9118a734bae33949883899e6f53cc65f7e6f557eaaa1bba51723209128c81
SSDEEP 49152:Qoa1taC070d3uU5yj3P/cdiaTtXgFFxs61tkz:Qoa1taC0o5ybPkZez/kz
TLSH
T1F8951350F3A4D2B5C0850570A162C7A29D792EBD9B449C47BFC81B7F3DA0FC16662B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2720-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3504-0-0x0000000000400000-0x00000000005E6000-memory.dmp