f1df8944fa2a92d0290eecba011c065c7e852402bf586254fbbc3d081688b67a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_6723b099632cea4ab90d79ddbe362e45_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260930-mwpcjs1cmf
SHA256 f1df8944fa2a92d0290eecba011c065c7e852402bf586254fbbc3d081688b67a
MD5 6723b099632cea4ab90d79ddbe362e45
SHA1 1b17d3a291cd47ec3541b91253a69b855d4144cb
SHA512 7dc59a3747a8c6eb515d1c560e62dd2a36b11b0e9188f8aed8b14a20703c26c61ac634d4db0d3c1cafc70506c6f95d71d681175228518a22fa5fba33d6840d81
SSDEEP 49152:Qoa1taC070dqbLdVctOBbifp/98nxtf0zuYsdZaBOklXK:Qoa1taC02UZAp/986Jsm0Sa
TLSH
T1A8952214F394C1B6C0C10A71A481C7E6D87A3EB947465C837BDC1B7F2AA4FC05A66B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
940	9E4A.tmp

Executes dropped EXE 1 IoCs

pid	Process
940	9E4A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_6723b099632cea4ab90d79ddbe362e45_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9E4A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 940	2400	2026-09-30_6723b099632cea4ab90d79ddbe362e45_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-30_6723b099632cea4ab90d79ddbe362e45_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_6723b099632cea4ab90d79ddbe362e45_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\9E4A.tmp
  "C:\Users\Admin\AppData\Local\Temp\9E4A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-30_6723b099632cea4ab90d79ddbe362e45_amadey_elex_smoke-loader.exe A69DE045C619A8537736C24975DCC0D665B38AFFCE2A33069B6702977876D3EDCE5FBD4A5F7D836F0F3590B2AF4F43AD539FD381B9C7802E9FD7CC357F24507B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9E4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\9E4A.tmp
Size 1.9MB
SHA256 77759db0608fc33c1c5ab63d1ae10c42925aec4063ab4dbe7de55aad4d2d448a
MD5 b0efa09efbeba880938aacd3dd1ede5d
SHA1 c959c97f3734de198df8e1423ba6403a06ff63aa
SHA512 368d89e78081d247904af7fbce9431c0c1f26dad03b6b94b31c71b37b1582b49965d597c19eee55802c7e4d8bf95189adf9ac5ac5e145fd3fc3bb8067d19f35b
SSDEEP 49152:Qoa1taC070dkXH++mAlu2AQDG7DZbGifU:Qoa1taC0x++md6IRGp
TLSH
T1A4952310FB81D2F2C0820371A6A2C392D8793E7856568D877BDD0F7F2D90EC55A66B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2400-0-0x0000000000400000-0x00000000005E6000-memory.dmp