8ce455264ff654a68e79cb0622f4e3829132ccce0a8427b2e773318961e0402c

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe
Size 5.4MB
Sample260905-jppsysgq4v
SHA256 8ce455264ff654a68e79cb0622f4e3829132ccce0a8427b2e773318961e0402c
MD5 6c681270ac56a05b5062986a1d3a76a9
SHA1 f5881feb067c6ffa27735b505de3416c9e4b4c15
SHA512 9a40fe937374451089969aff046603d6043b1d0bb0aa88bc5821ed1d5e5821ff59a4e7094a88831991026d2a243fa26e88f0adbced565a7e6480fd88b73c8ad5
SSDEEP 98304:emhd1UryeWmd3hMBzFg5rNV7wQqZUha5jtSyZIUh:el2yhqzFarN2QbaZtliU
TLSH
T12946CF0486F8DF2EC91F41B5E0A122669BF1E964E7C3AF967C52F1F43A43350B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5020	F96.tmp

Executes dropped EXE 1 IoCs

pid	Process
5020	F96.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F96.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 5020	3388	2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\F96.tmp
  "C:\Users\Admin\AppData\Local\Temp\F96.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe B38CDD2383C17F5C2B77FA6CFE814CBED3FC3FA23BAFB31947720420C7E3FE453D3AA13E6DABE5FB3F26163B79061DD9F469BAE99BA2C1630415F4D0313100EE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F96.tmp

Path C:\Users\Admin\AppData\Local\Temp\F96.tmp
Size 5.4MB
SHA256 2c91bf9584b6cef4de28e308ca3a86a8ba97a408ced28ae2426688e023ef7bd2
MD5 d1406cfc064e08b4c221829f099da0f5
SHA1 c33736288e66f2529d925459dbd34784c1e006e7
SHA512 50ab1077601fdd7383c57c70fa891fc61ec0a41cd428ba371dfdcce14264abf633ace824eeb99e1d05976b950d806f9bdfa54aae1a37e4a102b308b6314adff6
SSDEEP 98304:emhd1UryeZHlfGK4IU2wmYs4qV7wQqZUha5jtSyZIUh:el5HlfGQU2d2QbaZtliU
TLSH
T18F46DF0496F8DF2EC91F41B4E0A122669BF1E964E7C3AF967C52F1B43D43360B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3388-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5020-6-0x0000000000400000-0x0000000000849000-memory.dmp