e7d242748f8c117e06acafc79cd0e8422372214d1b8bfebb163981fc43b43076

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_88555bf22c5ee1ce56727214a77d2378_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260818-3ecv7at1ev
SHA256 e7d242748f8c117e06acafc79cd0e8422372214d1b8bfebb163981fc43b43076
MD5 88555bf22c5ee1ce56727214a77d2378
SHA1 9cce4ab18f9440d8e3ce7ded24f8865d968e8e75
SHA512 e2052bf033f39a3eec40a29ef71ba06ffcc5cc831edd160e0e608ab2247123f127a23879bd8268f4717b284abd3dbcab96d4c0074ecf461163d9c1ac71584cd9
SSDEEP 49152:Joa1tHC070UAH7ye0EYTybP/NijixILp:Joa1tHC0CH7ye0Jy7/NieO
TLSH
T114951259E7A48172D181C4BAE6A2CB67C473387693004DCF67E44F2B2E77AC5B630762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4744	4A7C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4744	4A7C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_88555bf22c5ee1ce56727214a77d2378_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4A7C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 4744	3740	2026-08-18_88555bf22c5ee1ce56727214a77d2378_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-18_88555bf22c5ee1ce56727214a77d2378_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_88555bf22c5ee1ce56727214a77d2378_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\4A7C.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A7C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-18_88555bf22c5ee1ce56727214a77d2378_amadey_elex_smoke-loader.exe 641794316B590B8758A421C1C0063828B6A7DBA0ECF334A577A4A2F5F68D6D1B292B37A17A5E45F516B0C6539906C1B100700BFB40217EDD7533EAB300D7972A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\4A7C.tmp
Size 2.0MB
SHA256 76bfad1f5bb1573093ca0b5d7938cb61c200f78cc3e09f52bdead6ef367ea503
MD5 0cc9e77eeb91b2f137763f662f3a8936
SHA1 c440a31958aaf47fc468eaf7cdf1dbf519fbaf18
SHA512 819b450c01793aa3649b6d06aa4a36d97702142d56c4b928bd38b4c8e1f89b03cdfb4692d4f0c39662af75b5856b6b677b938b55735e2c449e5355e448bb04a3
SSDEEP 49152:Joa1tHC070UHwfhTTOtyYKFpaWCmcNUUKqp:Joa1tHC0mfC9KTDc
TLSH
T1E9951259F7A481B2D091C9BAD592CB57C4B33876A3000ECB17E58B7B1D27AC5B630B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3740-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4744-6-0x0000000000400000-0x00000000005E6000-memory.dmp