6f95d657834eabc2834d4a5ab8e24b2eedd3602c4778eafd12664a2f5f4fcd14

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260825-3dtgjsxset
SHA256 6f95d657834eabc2834d4a5ab8e24b2eedd3602c4778eafd12664a2f5f4fcd14
MD5 92072162fbdb779ad3ae0ae26619f80b
SHA1 45ebc082387a73f1fa5263c7edc2baff6a8706d1
SHA512 d5710eb48490c95415a56ab95806b859f662c69bff363b0ba6ef337b2fc4100786ec889c7cbb94c4274ec4d69fcf7c0674c63df54b36810c6d57484cda6f2500
SSDEEP 49152:Foa1taC070U4/W1atukYNXwqvOJFIZQvOJFIRK:Foa1taC0/1atukY1
TLSH
T1AAB5F100F70474F3CA14AFB0665AEB9BA2507D7B3745DC8B6884629B1DCF5C89B11F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5956	797.tmp

Executes dropped EXE 1 IoCs

pid	Process
5956	797.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	797.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 5956	2840	2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\797.tmp
  "C:\Users\Admin\AppData\Local\Temp\797.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe 60F286431487B0BB0BF8C7F6B939152EFFD4A80A9F048944BF4D905A26B23D6457FE76DB611BA886CAEA5583D426337C6C6938B6536B682E0AE99FEC7A1F0C61
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

797.tmp

Path C:\Users\Admin\AppData\Local\Temp\797.tmp
Size 2.2MB
SHA256 9b5b24b0853ef9fc1f82c9af5df4d957b484b2f503822ab19c9fb650671092bc
MD5 69c648f05174206018d23bbadd47ac4e
SHA1 c739c61552854b8e0287127656fe4b11dab39bf1
SHA512 bc6c2b468a33f9271318c2b3879edd6223df66e523709032415380cccb6426ed1a0f4ca536ca3b4cd5585cc5c4454c01cdd48c180be950e4ecd70d97e9e4ab33
SSDEEP 49152:Foa1taC070UO04sYQSLno/OoGNeC07V2gE/OqvOJFIZQvOJFIRK:Foa1taC0P4OSTo/Dze/F
TLSH
T18CB50200B70470F3C6156FB0629ADB5BA2506D7F3745EC8B3884669B1DCFAC8AB15F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download