c339cc5d50383f352ecea8d8021d8389f237f2b60942bfb1fca02d815396925b

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260822-pbp5fstfnd
SHA256 c339cc5d50383f352ecea8d8021d8389f237f2b60942bfb1fca02d815396925b
MD5 7b1205b2a7d59f775718a873d45edc49
SHA1 920f02872d9af4b8310f32330e9ce844b953c6e0
SHA512 34ed942334955e0f5b962bb2e0083d1ad56f2af5e4f7fa47aa5aa409b8bdd6dcac9ae071a37bbea45cbb86ba40c0ff8e9ede55a1e763782b4a449a4b64a5df4c
SSDEEP 49152:Joa1tHC070Ubk497nVa8dWHWBbrc5NqMd/ChgyvFICUan:Joa1tHC05lnVM5NqQCWxCHn
TLSH
T1E2952200F790C2B6C0915A35E662C7B7E9793D789A408C87BBCD5B2E2DA5ED07A31743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1972	30DA.tmp

Executes dropped EXE 1 IoCs

pid	Process
1972	30DA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30DA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 1972	4116	2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\30DA.tmp
  "C:\Users\Admin\AppData\Local\Temp\30DA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe 3FE3CE00CFB494C5E0322E359A4B58C21BDFB83C9C2438A0B3BC1DE8A4855C039CE694319C0948CE13C926846F203E350680F61593845775D5CA56DAF4CCFCB6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

30DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\30DA.tmp
Size 1.9MB
SHA256 f5e81f6e4ae6cd84f1ed6c2d6bfb8eb1888bebe1d98acb5822ef6184edf46752
MD5 5b31bbb4cc70de2b3ccc4350692ae4d3
SHA1 73016e1a2dbd090f3da7d5e5161955bf1191aeaa
SHA512 086e8b67a16e74a5ce3408651622bc81e9fcab4494a7c2779775756fcb71d0af27144de96dcf005e95b3abad7a8189ef8854656b74a31cb445515064d29a302a
SSDEEP 49152:Joa1tHC070UYODg5Wj0Q0HOWJB2kLW8MH4:Joa1tHC0GOVwVOWOky14
TLSH
T1D3952240F785C2F2C0854472E661C3A7D9AA3EBD87029D836BC82B7F2A95FD06935717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1972-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4116-0-0x0000000000400000-0x00000000005E6000-memory.dmp