64b83175e89726a95949fd5d3b29529227f921989d274a5dff42ff491b84f76a

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_32dccf75e009bec47a3cb29a3bc849b8_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260930-2b72gssgmg
SHA256 64b83175e89726a95949fd5d3b29529227f921989d274a5dff42ff491b84f76a
MD5 32dccf75e009bec47a3cb29a3bc849b8
SHA1 9986b8fcd3d0bcebe81dab24da17da04d84aa4b3
SHA512 4d7683c08a54d7b8b9c0ef5f73ae828d20e05850ae295396fb177cb7d8d5e766f593ec6d55ed5ca99de68529ed333ce53fa0e7f5b1abe9f45ad429a3458dbc34
SSDEEP 49152:+oa1taC070UBNVYHNeK60RArBg7P5FdwbG0Fx:+oa1taC0RVqNeNaArBg7P5gbrFx
TLSH
T13F952320F79AC2B2C0C61A31A166C3A79C757D7D57468C837BCC073F6960EC4AA6275B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5072	48B7.tmp

Executes dropped EXE 1 IoCs

pid	Process
5072	48B7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_32dccf75e009bec47a3cb29a3bc849b8_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48B7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 5072	1096	2026-09-29_32dccf75e009bec47a3cb29a3bc849b8_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-29_32dccf75e009bec47a3cb29a3bc849b8_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_32dccf75e009bec47a3cb29a3bc849b8_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\48B7.tmp
  "C:\Users\Admin\AppData\Local\Temp\48B7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-29_32dccf75e009bec47a3cb29a3bc849b8_amadey_elex_smoke-loader.exe CAC9945F626DAF9F18B8807A46DF6FA631EF519FA249D4989BF0AF948A5CB0172FE797C1E89E73FFA4946341201B8F45AC6071DDE149AD7BC022AB668CCCA753
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

48B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\48B7.tmp
Size 1.9MB
SHA256 b3cc817b5ea5bbcc1f6ff613e5b81432c4055653d248ee2402a126084c1183e1
MD5 17aa38b8e9a1afd80403014de04383a0
SHA1 b93a8e94c2b63e9ca83ad49ca5de2d63a35b91a1
SHA512 66560263f5ea97170bcd64921bffc0fbd6d96d23490636e87d11109d4b43549fb916a3e5511addcad9d7610d40e2b8a03f8b6ce8a8701a6bd788cdf761c4c378
SSDEEP 49152:+oa1taC070UQQ3WEgNUZw0J4c2Ly2ocMz6WIY4sJ87eec:+oa1taC02QGtau0ujLFTWIjsA
TLSH
T1D6952350F785D2F2C0810671AA91C3EA98743E7C56465D837BC91A3F3DA0EC4AB72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5072-6-0x0000000000400000-0x00000000005EB000-memory.dmp