bc47e664daa127173621028d420d70dbb339107ebc9b66c659b6569ec280f52a

Analysis

max time kernel
148s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f9e2635f885edb6bf9192e2d9eae5b7f_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260821-ckq2wseq6x
SHA256 bc47e664daa127173621028d420d70dbb339107ebc9b66c659b6569ec280f52a
MD5 f9e2635f885edb6bf9192e2d9eae5b7f
SHA1 41e54d01fad9430005bf14547dea5d6571c02195
SHA512 b1d549e216b146996da32cc5cf46f6a3a5e1468d777a5c78dc8d8b2b8ba713d294fe1e5e5f8ebf7eafc404c3cc770981c86e06ee2afb5ec95db965019003672b
SSDEEP 49152:Qoa1taC070dmp52zvcVAzLKvlXsTxe64i/:Qoa1taC0v2oVuTM64s
TLSH
T16D952210FB91C2B2C1810671E5A2C7A3ACB53EBD57594EC37FCD5A2E1960EC06A36B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4268	962B.tmp

Executes dropped EXE 1 IoCs

pid	Process
4268	962B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f9e2635f885edb6bf9192e2d9eae5b7f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	962B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4268	3676	2026-08-20_f9e2635f885edb6bf9192e2d9eae5b7f_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f9e2635f885edb6bf9192e2d9eae5b7f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f9e2635f885edb6bf9192e2d9eae5b7f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\962B.tmp
  "C:\Users\Admin\AppData\Local\Temp\962B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-20_f9e2635f885edb6bf9192e2d9eae5b7f_amadey_elex_smoke-loader.exe 5F9429424CCBAA11BD20BC125816806C2ECCB27547B8543CE035A1B4247E33575A504AD0B7027C837DDFF873CE21BC4DDB88E34C95C66E7CBFB30C43896CC434
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

962B.tmp

Path C:\Users\Admin\AppData\Local\Temp\962B.tmp
Size 1.9MB
SHA256 8d9fa286ba18e29d52c316e38196c5a2703987f1e8c84590ee9bd3187c67d9a3
MD5 9ccabe1ecd64d51c5f0922f2a88bd9cc
SHA1 43bc456f3abcf54c07e7fb303c1eadb524bea2f0
SHA512 a3d8a6803f9d24308b86be4b44e4750309380b258acd12b6df18322b17e0a034d4d1816c1851fff6aa19ace065302b66d1499da69bbe07e2ac3706d237303403
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dgjROVgoz0D3SDcgeh/KZxDJ9obzQtTibMXr1:Qoa1taC070daR7W0bweZKb/obs2b+N/
TLSH
T13D952220F351C2B2D0950A35A291C7D79CB93EB947458DC77FC92A7F29A0EC06A36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3676-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4268-6-0x0000000000400000-0x00000000005E6000-memory.dmp