045217a4037e51f00ae9e0e3321892c14658676a56bc355304e02b15ddfb9783

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_ed8fd668699df2eb638d508fb4c31596_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261002-23n3pavdnf
SHA256 045217a4037e51f00ae9e0e3321892c14658676a56bc355304e02b15ddfb9783
MD5 ed8fd668699df2eb638d508fb4c31596
SHA1 d1e3ec9dd62253194c40f2f55bed73ef5df8a826
SHA512 5128e1564395a419df28b5bc12904f88aa8ab88379e5159179702cd1df0513fc53943462e46458812db5fdfa1fe3ce7844519a3cbedfe584cf1805fa27063b61
SSDEEP 49152:4oa1tKC070EB3jhQ0RIQb/mYjSe+IJqELGQQSSM:4oa1tKC07jhXRI+/m+/0ELa
TLSH
T1F0952350F385D2B2C0911672A596C3BBE9753E7C96005D837FC91A3F2A90FC06A72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4336	C99.tmp

Executes dropped EXE 1 IoCs

pid	Process
4336	C99.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_ed8fd668699df2eb638d508fb4c31596_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C99.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4336	4108	2026-10-02_ed8fd668699df2eb638d508fb4c31596_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-02_ed8fd668699df2eb638d508fb4c31596_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_ed8fd668699df2eb638d508fb4c31596_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\C99.tmp
  "C:\Users\Admin\AppData\Local\Temp\C99.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-02_ed8fd668699df2eb638d508fb4c31596_amadey_elex_smoke-loader.exe 4A8A438E9451B8924BD9D993D789E110305A1D2BB57AD4F711F2085BA059707A6CC8416B27D648550FBDF5F2BED9587A094CFF974933600B13385C9826190ED5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C99.tmp

Path C:\Users\Admin\AppData\Local\Temp\C99.tmp
Size 1.9MB
SHA256 053807198f427d8e4b955bb4e5de6bb04f80259e56987509f74a12a334f8cb56
MD5 864d153cc24df57dc30e13516c4c449f
SHA1 2933199f910e01d8dc854e979b4495847399d9d5
SHA512 999dbdc1492299895911a147eb5dbd51909571b98938bbd94c84ff7a7cd4de35ae32d13068c19a987bc17055c48375b5706ccc86e2dd092937f2a1e91dc54b04
SSDEEP 49152:4oa1tKC070E15wtljnyDAEpkDP3o1TQvzm:4oa1tKC0NgnOnSAS
TLSH
T168952251F791C2B2C0421A75A561C3E7ACBA3E3847498D437BCD1E6F29A4FC16A31B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4108-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4336-6-0x0000000000400000-0x00000000005E6000-memory.dmp