fb4b18d36f3009af8ff9a5be15ade5bf8385c133b47c2f9f01fc446aa61d9ad6

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_b20bffc9fdd99780f6a0821f15ac8010_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260819-falafada53
SHA256 fb4b18d36f3009af8ff9a5be15ade5bf8385c133b47c2f9f01fc446aa61d9ad6
MD5 b20bffc9fdd99780f6a0821f15ac8010
SHA1 15bd61c60baa0e00c1c8ef78eabf709ebca8b5e2
SHA512 dd314551a1d6f0e73e46847f73a743eac5325bbd0c307dc1a66dcde2264603474dda71a5eaa14ec4496403b4dab05a86fed81d57a432f478e142a0768c3a9925
SSDEEP 49152:Qoa1taC070dJD05qItEFBub/A+bjtC3GFOtk3uA:Qoa1taC00okFUbY+bjVk+3uA
TLSH
T1ED952250F7D2C3B2D0810631A5A2C7A2DD6A3D7E56864C837FC91B3F2990ED05AA6B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3148	95DD.tmp

Executes dropped EXE 1 IoCs

pid	Process
3148	95DD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_b20bffc9fdd99780f6a0821f15ac8010_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95DD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 3148	3560	2026-08-19_b20bffc9fdd99780f6a0821f15ac8010_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b20bffc9fdd99780f6a0821f15ac8010_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b20bffc9fdd99780f6a0821f15ac8010_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Local\Temp\95DD.tmp
  "C:\Users\Admin\AppData\Local\Temp\95DD.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-19_b20bffc9fdd99780f6a0821f15ac8010_amadey_elex_smoke-loader.exe 23438A230269F1AB74391BE27F3E5F11F19A71A094919F1DB38A4FFAF36243296CBA491D0D365203F2DB32970E9EA33EB2F37A87C1F91306A52485813958363D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

95DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\95DD.tmp
Size 1.9MB
SHA256 fcbebd92ac754e2bcd4b9d1fc4e801b80142341196dfe426c4a6b40871717442
MD5 e278f82d2f59c2071f3cacc7cdcfd11d
SHA1 0d239d48f7d7739fdbbac4f9aba36b7fd51a0405
SHA512 793564d98dab6b94d3800a600c35083c0fd9d819a1daa94aad10290afe27c07022cbe931ecdd91a0969483d7ba52f9c080396df1adba1554689d2092350fd34f
SSDEEP 49152:Qoa1taC070dTyhl6taqdQ238vFyxhPz6T/jfgb+MfLcwT:Qoa1taC0XhgdQ26yxh76jrqPjT
TLSH
T1AD952260F3D5D2F2D0910671A292C3B7D8652E7C86068D87BFDE5A3F2994EC06A32747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3148-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3560-0-0x0000000000400000-0x00000000005E6000-memory.dmp