b313699c4274e144bc69dfb0a94e831b53fca3d1433b0e37dccba5818f01d9ea

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260820-3dptcsxcph
SHA256 b313699c4274e144bc69dfb0a94e831b53fca3d1433b0e37dccba5818f01d9ea
MD5 c4b37948129635d4eaa3b9a2d1cc8717
SHA1 8bfc2e849594f077381945ff9f0e7a2b3b93e477
SHA512 b1fc35bc70f58d9675fa5b8e8384924062829fe7a63aee1b275b209f7d94fba02f3b81604194fa72e0775c2eb7482039394534067c76e1f67f028f918236c956
SSDEEP 49152:Qoa1taC070dCkK/9KOfc5Seja4koiEaqocsbpG3w5k:Qoa1taC04eenslsoceWwK
TLSH
T1DC9522A0F791C2F5C0800671A1A6C2A6EC792EBC57914C833BCD6B7F5DA4EC17A32657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1284	3704.tmp

Executes dropped EXE 1 IoCs

pid	Process
1284	3704.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3704.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1284	4880	2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\3704.tmp
  "C:\Users\Admin\AppData\Local\Temp\3704.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe CC8BB875D224E5F4B856BC0A4C5F1B8955C4D3BFCA80BB4F50B722C348741DF9BCDED067A3634995FB91A0F89D77E9EB06B9AC10C51821C904FE2B972C01A01B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3704.tmp

Path C:\Users\Admin\AppData\Local\Temp\3704.tmp
Size 1.9MB
SHA256 b65826fa6d526197b03f2caf649861517548b4424ba57ceb012915b98ffc1799
MD5 6d3cd5c09ce0f996ad8ffaa5b9705f8b
SHA1 85cd0cc53f722e98b535bbfb56661473dbac6a96
SHA512 c92c946fad37f615831acfb16f1b0a88b14b928e19f7afac169a988de4954b6c4a9cd1c18913da7ef0376cb2ecd33ecda9646e61c5ef1513d46126c9e13b028a
SSDEEP 49152:Qoa1taC070doT1jclB+gaFncPVNH1Q1/WeHM:Qoa1taC0xk+ga29NH1QJ3HM
TLSH
T126952350F395D2F6C0860A70A691C7E2DCAA3D7D9B549D837FC91B3E2860EC0A771A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4880-0-0x0000000000400000-0x00000000005E6000-memory.dmp