4cb3008c69b25d50ee55311a32a0803b706680cf22aefc9b5972dc8f5ae1adf6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_2cfc43c8976e7c347b09b195c9fbfa8f_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260822-vsye2sam2s
SHA256 4cb3008c69b25d50ee55311a32a0803b706680cf22aefc9b5972dc8f5ae1adf6
MD5 2cfc43c8976e7c347b09b195c9fbfa8f
SHA1 43a5d08c373cbcbf70be819d85e11375dca704b8
SHA512 f2c4e6395ad5518af17daf2c384832678deb7cc2075d7bbc2fee68a46bb466a7bc823632edb9ecdaf6e60fca6c17a502493886984c606c93e86a1e4ef233ebef
SSDEEP 49152:Qoa1taC070dLEuLO9vLEabUDvtaO8A1YkRNJq1Ay:Qoa1taC0gLYvW0VEZRNJq1z
TLSH
T109952394F7E4C2F6C0800A72A652C7F2DC693D7D97058D877BCC2B6F2984EC06A61B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5956	8C0.tmp

Executes dropped EXE 1 IoCs

pid	Process
5956	8C0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_2cfc43c8976e7c347b09b195c9fbfa8f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8C0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 5956	4624	2026-08-21_2cfc43c8976e7c347b09b195c9fbfa8f_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-21_2cfc43c8976e7c347b09b195c9fbfa8f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_2cfc43c8976e7c347b09b195c9fbfa8f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\8C0.tmp
  "C:\Users\Admin\AppData\Local\Temp\8C0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-21_2cfc43c8976e7c347b09b195c9fbfa8f_amadey_elex_smoke-loader.exe B70B1AB83318B96A8403FE9F26C61F9343C0AEABD6336367CA96AAB39905B910D5898343EDDC4BBDCF98695C25D3EE519EA5A2345504AEB87C92DCDE28CB86DF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C0.tmp
Size 1.9MB
SHA256 c9a9d91e37afdea4aa4f94aba8ffa0b1318331c8ed1dc95cac93494d201e4bb1
MD5 b0fd9d54d90ed0badcf6340e03d55409
SHA1 46a0766ab5dae8d017631ca21824dde7a5ba4482
SHA512 69cb995c7b32712dfb589505736f9e1bb8f0ebc0a65d5697c829f32bb25f216f212376b1bb922ee9ce6c4e9bf006a574d4be09e3569e0073c27275ef43f6a41b
SSDEEP 49152:Qoa1taC070d5rcNQWd717QbXL8euDS/R2z:Qoa1taC0qrCQUpQbIDP
TLSH
T1E1952310F791C2B2D0810675B542C3E6DC7A7E782A864D837BDC1B7F68A4AC06B72B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4624-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5956-6-0x0000000000400000-0x00000000005E6000-memory.dmp