b2e31e6f65d2e4edf9bbf1c34661c520bffd2177c10d7614fcd3431e0bebfd82

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_e24f6558fb5a1cc82940a0c918548f7c_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260822-a45chszdpc
SHA256 b2e31e6f65d2e4edf9bbf1c34661c520bffd2177c10d7614fcd3431e0bebfd82
MD5 e24f6558fb5a1cc82940a0c918548f7c
SHA1 f36b6f866104ea0ef3f397bd71eda6bb3756177e
SHA512 b410b293e491610b8597fc878c9297d8d8d73bcb6755a8da6817bd03ac9917de42e97095465ca0795289c2d1f90ccb022780e6879ab55e7429ae2aacf94c7773
SSDEEP 49152:Qoa1tLC070r419sE9pvK9bxBIOOA1sxz8Yehl:Qoa1tLC0dN9evJ1sd8YeP
TLSH
T169952352FB81D2F2C0410671E5A2C7E2D8AA3E3C4B559C877BC81B3F6DA4EC46A61747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1180	836F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1180	836F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_e24f6558fb5a1cc82940a0c918548f7c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	836F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1180	3076	2026-08-21_e24f6558fb5a1cc82940a0c918548f7c_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_e24f6558fb5a1cc82940a0c918548f7c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_e24f6558fb5a1cc82940a0c918548f7c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\836F.tmp
  "C:\Users\Admin\AppData\Local\Temp\836F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-21_e24f6558fb5a1cc82940a0c918548f7c_amadey_elex_smoke-loader.exe 4EE85B5E3A39955A545CEE7FF6456455BCE5A5312D522170EA45F6FCEFD5DF2A5A55D72DFCF8333CF69177AB6E7BD316BC87CA2AA9D9520F207BAA6973E835AB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

836F.tmp

Path C:\Users\Admin\AppData\Local\Temp\836F.tmp
Size 1.9MB
SHA256 97c18ac9c4c9ce1f49ecf8631036ee7a6950a788fed7709415ef025facb043ec
MD5 af8abf9c4c6abcdf9f1d6f60396d5144
SHA1 5bacbd98e78fbb62f347c47a815671c53cc5158b
SHA512 0568e278dd362eeed9e9814d207a4e1453ed7dded38a6016c09745541916ec86058d4053c42a2d8856b1fabae21f7898c96ebd2d26d617d816a5979583aa310e
SSDEEP 24576:N2oo60HPdtV1CRiY2eOBvcj3u10r52jd5lpPpVMP7DS/EfxxG6CjZQfXJjylzQxy:Qoa1tLC070r5+nI+/ErPCjZmXJGlzesL
TLSH
T15D952311E785D1B5D0810971E692C3FAA8693E3C53569DC77FCC1A2F2CA4EC0AB7660B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3076-0-0x0000000000400000-0x00000000005E6000-memory.dmp