fca60f5a0174475965c6a9c59d828d21be85a816f3c3c0e29e2f6be4d9bf1e97

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_a53ec1101798adc959a8f03f543dbd27_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260820-3mrdjsxele
SHA256 fca60f5a0174475965c6a9c59d828d21be85a816f3c3c0e29e2f6be4d9bf1e97
MD5 a53ec1101798adc959a8f03f543dbd27
SHA1 85f3a2f1003ffabd74fadbfea4c9992a45533151
SHA512 b96342e6b7d69314c7cd6eae51d465919454b48756ea77af5e55468496182365f70a376f7a0b92793a0b2188108d55112bc1af68eda19c2993f6f494b127686c
SSDEEP 49152:Qoa1taC070daQX4sI+8DZU4mExqZMDBb2553:Qoa1taC0lYbOUzEsZV53
TLSH
T1E1952350F791C2F2D4820A30D562C7D3DCAA3E7D56459D83BFD92A2F28A4DC07A26B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4340	796C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4340	796C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_a53ec1101798adc959a8f03f543dbd27_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	796C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4340	1860	2026-08-20_a53ec1101798adc959a8f03f543dbd27_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a53ec1101798adc959a8f03f543dbd27_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a53ec1101798adc959a8f03f543dbd27_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\796C.tmp
  "C:\Users\Admin\AppData\Local\Temp\796C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-20_a53ec1101798adc959a8f03f543dbd27_amadey_elex_smoke-loader.exe A55EDCC586802590682CE136D3BE3EFB8F670BEF0B06F88E512CE451C72AF95B68DCE22792C59EDEB4E7E1912903B8F8A5941DE6399E5E91C54C5C702EB2090B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

796C.tmp

Path C:\Users\Admin\AppData\Local\Temp\796C.tmp
Size 1.9MB
SHA256 2b61c218a802d517b8d974d776176fb455ddfa199e9f33a098ce815a0b26c2aa
MD5 d6beb8f236d9578cf5924166988851b5
SHA1 b5802201429587e85fe0c191df6dda0b00402881
SHA512 861d0dc26c0297d554ce2ae7e4c37681d892eaf7c3726e52deae6d5bef3a9337078b3ad1e48d13333c2803b75700c11ff458c4aaaf05f4e3d38d7a2ff9b3dfe0
SSDEEP 49152:Qoa1taC070dAAzbGGcw40PuiSa7f3qeHFwbI/IK:Qoa1taC0E3GGcfqSAP9HFwbcj
TLSH
T159952360F6D6C272C0510A75B512C3E698A93E7893419C83BBDD2EBF2DB4EC06A70757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4340-6-0x0000000000400000-0x00000000005E6000-memory.dmp