f53f1c9bb12aa89f23023f2bec6d65eb1b07abdd5e8b82863ce5e886ce85883a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_7e8fa502958f023f69e308d6ca0ff943_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260820-pj4mtadc78
SHA256 f53f1c9bb12aa89f23023f2bec6d65eb1b07abdd5e8b82863ce5e886ce85883a
MD5 7e8fa502958f023f69e308d6ca0ff943
SHA1 822d7db0df46d94ae61dfc8abcd99f4c74d66f7f
SHA512 ffd188003feb7c9e07559fc56822ccabb99b76bb556565cc7668cc82adde14ae7aa12da2e90898d5017ef0c992055d12b735dcbbaf735501bf062acb08af8d99
SSDEEP 98304:emhd1Uryer0odHBmGEeOVLUjH5oxFbxCVLUjH5oxFbx:elQo1gGEeOVUjZEdCVUjZEd
TLSH
T1CF262340BBD4C261D1C275F9648343DACA343F7D5536998F2FCA3A2EDC695E272B8242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3940	95AE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_7e8fa502958f023f69e308d6ca0ff943_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95AE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3940	3848	2026-08-20_7e8fa502958f023f69e308d6ca0ff943_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_7e8fa502958f023f69e308d6ca0ff943_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_7e8fa502958f023f69e308d6ca0ff943_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\95AE.tmp
  "C:\Users\Admin\AppData\Local\Temp\95AE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-20_7e8fa502958f023f69e308d6ca0ff943_amadey_elex_smoke-loader.exe 7C55AD982A5D2F8A3FBC576620BC7B36D1DD1D918A34E5E9F96534A1B4E1BE123D2B76928523C1DE4C60A7E9744028CF8C3B9484A371D7A684A526DC40B5E641
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

95AE.tmp

Path C:\Users\Admin\AppData\Local\Temp\95AE.tmp
Size 4.2MB
SHA256 54e5906e2a44fd87bc1b9ba322f814e3bee686cd39f1e26cacc2d1a38f5882b2
MD5 aad966d5f8b2ec9f2c1b1521e58a3543
SHA1 efa999f2f8b925d62091ce7f080d6a9aab97f53d
SHA512 8e2f5dabae0a1b28d110e9fa012fb81c5e6a0b65fa7304a33d39c000c40014262d9a5131c627199f5262f22d487c29b942d01f2ed5600218d4decdc2cfd5da0c
SSDEEP 98304:emhd1Urye70WZk5kxpG4onJVLUjH5oxFbxCVLUjH5oxFbx:el4Wnxp0nJVUjZEdCVUjZEd
TLSH
T10F262350F7D5C261D1C275F8648347DAC9783F3D0636DA8B6FCA1A2DECA88E17678242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3848-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3940-6-0x0000000000400000-0x0000000000849000-memory.dmp