5231ea5c44183c070d277a0a50410263ce24a15278ac486637a8156f042fdc92

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_5bb77dcba0efcf02cd39af9c764caf62_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260821-ake9aage48
SHA256 5231ea5c44183c070d277a0a50410263ce24a15278ac486637a8156f042fdc92
MD5 5bb77dcba0efcf02cd39af9c764caf62
SHA1 54d60f6e9340298a4f0e4bcb0b5f4d32e085668e
SHA512 99c64b99a1677356128427d054c6a5689d6b9f0f4c999849903dc98fcea1e68dc58564242d972de6c80502a8f95c0e8c7b790d69d19f6d1b1cfe523512598769
SSDEEP 49152:+oa1taC070Uy3G0RkZ/UEf86KR+OUJfAZf7zqsVa:+oa1taC0gBRkFUBRzYfAZHb0
TLSH
T11966BC10966AF3518A802930997EB659D4E4ADA487FC58F37D8C3AF9D773BE33532201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3224	91E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3224	91E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_5bb77dcba0efcf02cd39af9c764caf62_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 3224	3916	2026-08-20_5bb77dcba0efcf02cd39af9c764caf62_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_5bb77dcba0efcf02cd39af9c764caf62_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_5bb77dcba0efcf02cd39af9c764caf62_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\91E.tmp
  "C:\Users\Admin\AppData\Local\Temp\91E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-20_5bb77dcba0efcf02cd39af9c764caf62_amadey_elex_smoke-loader.exe 287BE5FA65686AE6EAA7C7A458A408F50C0213F7C9F4F597F0DA46E3C39DEFEA1A9A7CA10538BD7D0A01E271451856A5C006EA9AC8BCC1CDBFC13A15699C7508
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

91E.tmp

Path C:\Users\Admin\AppData\Local\Temp\91E.tmp
Size 6.5MB
SHA256 58b30c07fec0ef5f6d3847f91d75b521fccdb3e78b1c4ebbd3719465ee6be5c5
MD5 699444a81fd0af65e350e9804f5917e6
SHA1 9aaf5913c4208d7aacf11a6410827a744ffdfb2c
SHA512 4f8813eaf141fdd33e127cfa7a09b488ac77ce589b426e77bf3d1a092ca2d8d08d022dd5cd8f135c225536a4a491564a2ed9c3150d50770fa6312022784db63f
SSDEEP 24576:v2oo60HPdt+1CRiY2eOBvcj3u10UjVpg4MsYwacVUXKDYuubHrQwsp:+oa1taC070UhBY1cVUaDz
TLSH
T17466CD00916AF3618A802870997EB259D4E4ADA483FD48F37D9C3AF9D773BE37572601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3224-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3916-0-0x0000000000400000-0x00000000005EB000-memory.dmp