d02aef7fee6c8e483af40bc7d2e6806febd9c87a15434cca28976a83e60acbc7

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_eac0eeccad7845e1d0e6f963e3f0c7c0_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260819-ejg4psxzht
SHA256 d02aef7fee6c8e483af40bc7d2e6806febd9c87a15434cca28976a83e60acbc7
MD5 eac0eeccad7845e1d0e6f963e3f0c7c0
SHA1 08e0812b6b7ac95f3317fe39048a61ccca5ecd42
SHA512 55d0219faed521ffb1b7c430c29085db24d6361d8e8e4a5d770e817e0ce975015f4fc04fda2ef224743a40e807f989ecb2b7fbce6f7300310be3634f9e3e6395
SSDEEP 98304:emhd1Urye5yh/7Htlq63c6ShVLUjH5oxFbxCVLUjH5oxFbx:elQ/7Nln34hVUjZEdCVUjZEd
TLSH
T1C4263380B7D5C365D1C275F9648383CBD5343F3D45669A8B6FCE1A2EECB89E22274242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4440	4201.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4201.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_eac0eeccad7845e1d0e6f963e3f0c7c0_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4440	2916	2026-08-19_eac0eeccad7845e1d0e6f963e3f0c7c0_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_eac0eeccad7845e1d0e6f963e3f0c7c0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_eac0eeccad7845e1d0e6f963e3f0c7c0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\4201.tmp
  "C:\Users\Admin\AppData\Local\Temp\4201.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-19_eac0eeccad7845e1d0e6f963e3f0c7c0_amadey_elex_smoke-loader.exe 67400DF78C7C340CDFDBD7951E212BD434116C87F0AB7D7B658D92AFB35E62B83BA5ABEFCE8FDBB2581B22659924D11FF44F94006FB28103AC74AC8768C4AD5C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4201.tmp

Path C:\Users\Admin\AppData\Local\Temp\4201.tmp
Size 4.2MB
SHA256 38e152cb21749d4a6b416c3076dc2c2cca4f1e612b17215f0b1cb5ad116e7282
MD5 42040f5e4e16ff5953ffbb07e0378ebd
SHA1 ed8090e89043e2b706d6c9988ff0f27fbc8e8ba2
SHA512 a7fc828fb2185b7347f386b9bf43442a43aabecb9e09e72f301e4c487f27713cc42e8a74509d970f8eaf351eb87ec7be889979b946b6b7ca87f4afc64de8a7fe
SSDEEP 98304:emhd1UryewP+80B55ksEVLUjH5oxFbxCVLUjH5oxFbx:elQPb0HCVUjZEdCVUjZEd
TLSH
T1C6262340BBD5C762D0C374F964C383DAD6783F6D457A994B2FCA2A2EEC644E27274242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2916-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4440-6-0x0000000000400000-0x0000000000849000-memory.dmp