b482d9399c4cc0c6ac110e9304e673b21b1f864de338c218a4ce148ea911e03a

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_38ca538199634f3599ae54c06acb095e_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260818-mcmdvazgpb
SHA256 b482d9399c4cc0c6ac110e9304e673b21b1f864de338c218a4ce148ea911e03a
MD5 38ca538199634f3599ae54c06acb095e
SHA1 701e238a6bc8d30a63b5d617104c7c34cdd7c30e
SHA512 100b8abb42e3fb97d6583d7da101a0da0f53d7cc5fb09fe9b4e6c7ed838f457784946eade06c63d9fb179413801ad102f617d0537fe6ca06660bb8854cb424e0
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dR8gcBFo50W+l/8sRfCyR38V0/MJPv8Z3xjt+:Qoa1taC070dRK/TEx98lFpifH
TLSH
T18B952350F7D4C1B6C0D24A71A155C3A6E8793EBC1A418C837BCD1B7F19A0EC4AA72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5012	DDA9.tmp

Executes dropped EXE 1 IoCs

pid	Process
5012	DDA9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_38ca538199634f3599ae54c06acb095e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DDA9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 5012	4148	2026-08-18_38ca538199634f3599ae54c06acb095e_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_38ca538199634f3599ae54c06acb095e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_38ca538199634f3599ae54c06acb095e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\DDA9.tmp
  "C:\Users\Admin\AppData\Local\Temp\DDA9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-18_38ca538199634f3599ae54c06acb095e_amadey_elex_smoke-loader.exe 9B8E3BA5229FEC557ECE34C8A3109555433C03654A57547261A10310FDCD63A102BBE2B73A5C58FC0716EC64B38004C0FE4F5F002B4DC6EA5AF3FADA976C5F82
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DDA9.tmp

Path C:\Users\Admin\AppData\Local\Temp\DDA9.tmp
Size 1.9MB
SHA256 93d6aeb8789ed60b3d7e2d842a85b6124a6cd57ec3b488c342c01492924ca8a7
MD5 22d4d18ca427c4e0344368d4cfc6ba34
SHA1 883d7ade606c7078c2520e5d43fe62caba6a7924
SHA512 15be6c4a70a35ea6b98a4be13a94d81c25ae78951682c6769764c26289ce2e33137018d0536f85e6512560eb1c9c7dbf92c1d17ff751b4651c6ac5d97686a68c
SSDEEP 49152:Qoa1taC070d47/Uo3+57kWJSk9zFeilWs3uN:Qoa1taC0hPe7kWJSkNAMuN
TLSH
T1BE952261F784C2B1C0911A70A561C7E6E8A93EBC4A419CC7BFDC2F7F19A4AC0563479B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4148-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5012-6-0x0000000000400000-0x00000000005E6000-memory.dmp