a8316a910dd395a66ad9e13115b23269220dbfb5d8ff86a6573f7df0e259aed8

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_f39669be521b75a6556781b07af6fa45_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260818-pxdcsatwey
SHA256 a8316a910dd395a66ad9e13115b23269220dbfb5d8ff86a6573f7df0e259aed8
MD5 f39669be521b75a6556781b07af6fa45
SHA1 82902a5b1903cbf75348e3267bb4903dff4f3afd
SHA512 b1d4933d863ac17f7da41415684efb7e868035a4db382744ad20447fc69fb825de8268ace2f06eab18bb1f70b6c4e2237e7f78fe4754fdbccef169debd4ac7b3
SSDEEP 98304:emhd1Uryewh3JLtCLNGWKW40I6oV7wQqZUha5jtV:elw3KLNGWX40I6o2QbaZtV
TLSH
T1C026CF0896FCD92DDC2F52F4A1641185C7F4A564EBD3AF997DA2F1F029823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5748	78DF.tmp

Executes dropped EXE 1 IoCs

pid	Process
5748	78DF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_f39669be521b75a6556781b07af6fa45_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78DF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 5748	6076	2026-08-18_f39669be521b75a6556781b07af6fa45_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-18_f39669be521b75a6556781b07af6fa45_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_f39669be521b75a6556781b07af6fa45_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Users\Admin\AppData\Local\Temp\78DF.tmp
  "C:\Users\Admin\AppData\Local\Temp\78DF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-18_f39669be521b75a6556781b07af6fa45_amadey_elex_smoke-loader.exe F0455B6610BBE3675A3E13D72DBB274FF1671DDA22DACA13D0FD2F14AA34F362441E522B1975081EA9091659BA3EFAB361CA0D4158A8EE4ECAAC3CCB2256E13B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

78DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\78DF.tmp
Size 4.2MB
SHA256 94a391876c60540eed9ff68723ccaef34b32635bcfaa807b2877957c31480141
MD5 2124a1c0e79679bc70d33d1404a84eaf
SHA1 bf52ee4895a9d5d9d065c41d1244b544ae26d6a6
SHA512 ff560d52da75710deb51fb8cc586af4b7d4ea661cf91a72f2db56621d448f8ad944c6c0a0fc4b6fa98fc7f359bf8512ffc67b361e9224898766bf1f2ea505e49
SSDEEP 98304:emhd1UryevhQoO43e2VGE9aVTV7wQqZUha5jtV:el5QoO4u2jiT2QbaZtV
TLSH
T16226CF0896FCD92DDC2F52F4A1641185C7F4A564EBD3AF997DA2F1F029823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5748-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6076-0-0x0000000000400000-0x0000000000849000-memory.dmp