1572d221b05cd75dcf58bc43a0b888ee81dd90ff58d3b4dea38e68a41f25d3ed

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_e1641a96d09b0e602fe172cdd3dfc058_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260825-1c4vsazale
SHA256 1572d221b05cd75dcf58bc43a0b888ee81dd90ff58d3b4dea38e68a41f25d3ed
MD5 e1641a96d09b0e602fe172cdd3dfc058
SHA1 de4350895e1141df4994d1838ece4f10fa608fd8
SHA512 f39bac37df67cbc14cbef8ab6e34a69bb1f56b999721c0324b6a154851675ceb924aa54448f72436b87debcdd0f8c18354a867b6a0b5c8f583499759b683b671
SSDEEP 49152:ioa1taC070U4PhAkKW4cl2eWmrerCdJjs56RHY8aQvOJFIRU:ioa1taC0aP60l2eW+erY9c
TLSH
T1DAA50200B700F0F3C5556BB0669AD79FA67029FF7745DCC77984239A09CA6C89B12F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3392	3733.tmp

Executes dropped EXE 1 IoCs

pid	Process
3392	3733.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_e1641a96d09b0e602fe172cdd3dfc058_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3733.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 3392	3164	2026-08-23_e1641a96d09b0e602fe172cdd3dfc058_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-23_e1641a96d09b0e602fe172cdd3dfc058_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_e1641a96d09b0e602fe172cdd3dfc058_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\3733.tmp
  "C:\Users\Admin\AppData\Local\Temp\3733.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-23_e1641a96d09b0e602fe172cdd3dfc058_amadey_elex_smoke-loader.exe CAE072C2D5E21A9768D07DCCE5327B6D23DE359B9B4F99C87E5E736C1C214B8DF21705D8D6ECD987C60D844F91B69D457ED97D04B3FE00F42C8D398C62EAF127
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3733.tmp

Path C:\Users\Admin\AppData\Local\Temp\3733.tmp
Size 2.2MB
SHA256 971bf7dab804fa1967b43fad1ec1f84d8cd1c1b94a7e7f444df33abfb9c68897
MD5 970f9f4d09b9e5932f394cbbbdbee89c
SHA1 2ce03b31b89824817e8a83b9f17368db9169d2ad
SHA512 820ec1af14557811f94d2f6bde87f53c574997609a83fb3d43f47b080d40783bdde6772f9262f44f19d8b75da325992e0565d08ff22c90073d76127593e8beac
SSDEEP 49152:ioa1taC070UT5O84DkCqJAhIRjKWzdv5iUCkDzQvOJFIRU:ioa1taC035eJYMWza8/
TLSH
T16FA50201B700F0F3C5056BB0665AEB5FA57029FF7B05DCC73984669A19CBAC89712F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download