ff5abdec4d175de4c2af3378dabd323652507b10dfe821826b30fdc6a104dac4

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260818-2wtplasckd
SHA256 ff5abdec4d175de4c2af3378dabd323652507b10dfe821826b30fdc6a104dac4
MD5 d396f7f39233aeebedce7947a6113149
SHA1 952aed19eae608c9ec0e4ce8649d592bd532d1e7
SHA512 a50b96dca18c8df1df754d6cec9313c8197da5e5a732bcd0343b1947c36d823b17fcde3dabb3c91116d7b91ade415a6cd3b023a0e3027cc284a591089ac400dd
SSDEEP 49152:+oa1taC070U71DbLy5Z2y45lv/LjfkeR6E+P:+oa1taC03uE5lvPvRgP
TLSH
T1FE66BC01956AF3618A802970987EB159D4E4ADA483FD48F33D8C3AF9D773BE33532646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1300	60D3.tmp

Executes dropped EXE 1 IoCs

pid	Process
1300	60D3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60D3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1300	4076	2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Users\Admin\AppData\Local\Temp\60D3.tmp
  "C:\Users\Admin\AppData\Local\Temp\60D3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe 881B8035E57F583F7BAE0D316B6E5A5EBC21B808DF6D4132E4F9EAC32ADA4025A8F807EC9C72B9E7E45618289191802C8EB5E14A4F00FB3D3DE998F5F8C2C460
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

60D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\60D3.tmp
Size 6.5MB
SHA256 c7be7a386688888575dcc60fe1a1508be17a8f30c09dc030ddddd71cd0854701
MD5 5e2a740928adae3c72788b4e654d7454
SHA1 fee730f56ecc302cd17e80e13d57129cd8d37c57
SHA512 2c5bb98d0157dcc28ea6ceae3023275381b8782790858a2895f96183b2284ebdec5f15e6d8e6c98b8d93055f3cf8a098bd7edff4fa2bd16d9843e512baa43f2b
SSDEEP 49152:+oa1taC070UPyUG9oiLc1SNa6YcCZ9JsmGD9R0BzU:+oa1taC0Ed9occ1iaeCZ9qb0BzU
TLSH
T1B966BC50916AF3618A812930997EB659C4E4ACA483FC49F33D8C3AF9C773BE37576205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4076-0-0x0000000000400000-0x00000000005EB000-memory.dmp