71b6d3f27785cff527fc95f6574df05772b4d60c683ead48df197c3fe0650898

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260905-krydjsch74
SHA256 71b6d3f27785cff527fc95f6574df05772b4d60c683ead48df197c3fe0650898
MD5 648656a73da2f561f8a01f3012a341d4
SHA1 17ee9cfc81412e285f4ae5af2aa4eedd80d750a1
SHA512 15449e387c163fa4d535149554cb47b54a2df50117d2c1d7b0f3bfaf56870f4674ccd69649c8632c9e0dad075ba41449d4f39a5254edb2c03d1ec480e03be731
SSDEEP 49152:Moa1taC070d35Bah9RIsETB8d5BTvW/RwEW2TG:Moa1taC045BMosEV8dDTvW/1TG
TLSH
T100952390F794C1B2C0911672F291C6E298697EBD97468D43BFC81B2F2DA4EC06E72717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2616	FBB1.tmp

Executes dropped EXE 1 IoCs

pid	Process
2616	FBB1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FBB1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 2616	4188	2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Users\Admin\AppData\Local\Temp\FBB1.tmp
  "C:\Users\Admin\AppData\Local\Temp\FBB1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe 3ABBA1C893D5AC063AA586662B31ED8B8CC222D6FF1A4881FB02713D8376A4E6CD9CDFC1C7670AC5DFA09874DC996697415EFB543DE7B638587AF02359F8581D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FBB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\FBB1.tmp
Size 1.9MB
SHA256 7242a10d10ea2f060732f238324e64b059d068c3da9071759de84143ec7101da
MD5 bf0a90ddbea72a02ac2c81a49c4de68e
SHA1 b99007879358940c52e2b8efc8281678fe3f9ca9
SHA512 7acf4f99c136fbbe34543c88856b437fd82f59034a69aacdf1f766108f07e5cba8bce8669ef929221d0e454d93b756d67ece96d0c5b444b5ff8db74b841619a7
SSDEEP 49152:Moa1taC070dzdftojuWJchiPLlfQAgtLnMhK7Z:Moa1taC0evo55T5QAgtLMw
TLSH
T18C952220F795C2B1D0814671E5A2C3E6D8693EBC6B494D87BBCD0B6F2D90EC06A71B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2616-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4188-0-0x0000000000400000-0x00000000005E6000-memory.dmp