022b096512be6ced4734162317fd2cd78cbad268d6258cc3b30ab4da30522cb9

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_be8ac3349283ab332066dd9f5008e4b8_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260820-3fdh4sxcrd
SHA256 022b096512be6ced4734162317fd2cd78cbad268d6258cc3b30ab4da30522cb9
MD5 be8ac3349283ab332066dd9f5008e4b8
SHA1 28993dd31c692905db9c19beb2ac7dc1a765c53c
SHA512 e14cd1e637d2d967ebf9bd1268474ca44e2c50f6367bcc4b955712c5a65fed59ab062689cfa29b503184c0e03d9d0368c17f7a58de547f8e52ee3b3e351355ac
SSDEEP 49152:Qoa1taC070dsP1Ay6pWBeNAf8fkATDhQRw:Qoa1taC0JGbpTC88uDUw
TLSH
T16E952261F755C3B6C0421671E251C3E29D6A3E7C9B418C83BBC81B3F29A4EC16A75B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4752	8E8A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4752	8E8A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_be8ac3349283ab332066dd9f5008e4b8_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8E8A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 4752	6004	2026-08-20_be8ac3349283ab332066dd9f5008e4b8_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_be8ac3349283ab332066dd9f5008e4b8_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_be8ac3349283ab332066dd9f5008e4b8_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Users\Admin\AppData\Local\Temp\8E8A.tmp
  "C:\Users\Admin\AppData\Local\Temp\8E8A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-20_be8ac3349283ab332066dd9f5008e4b8_amadey_elex_smoke-loader.exe 3499B2578D06C2BBB8831995C91A53634FAE74C6E5C1D32A10A59862D17E2D5C5611FCE2306744F431EFC9EA59D4BFC3D4DF3C861D9BAC2B5DC3852D87349B73
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8E8A.tmp

Path C:\Users\Admin\AppData\Local\Temp\8E8A.tmp
Size 1.9MB
SHA256 045ce1cc86a3c73bd8d5dcbf6eb01e5548b8fffcb02f54f584e43348ec5dd067
MD5 6198e0e11104d4e328363726050ef185
SHA1 b789d230d6815e8802a63986287265bf28396979
SHA512 adc8f4af20b4e1372263de411352480ba55b998e2c41a77a9b4b617f1c2979a019a9e568469436cdccfa356e6375d9281302db519154b9085c9c98d37040386a
SSDEEP 49152:Qoa1taC070d94/n/9Cuo+dTizA3jCmkK+L/l6:Qoa1taC02qPjdTizA3jCmk/L/s
TLSH
T17F952361F395C1B2C0821671A662C7E6AC693E7C87468C837FC90B3F2954FC06BA6757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4752-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6004-0-0x0000000000400000-0x00000000005E6000-memory.dmp