e862eb2f20367a002530eaea3ef2ed907bbb2fbb2902575b7853c74fbc600649

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_31001238fafab7e8d52575d3bbab58bf_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261003-sekwpasyew
SHA256 e862eb2f20367a002530eaea3ef2ed907bbb2fbb2902575b7853c74fbc600649
MD5 31001238fafab7e8d52575d3bbab58bf
SHA1 5510878f3e712c398faffee0585811c337cd70a3
SHA512 dd2ee222776a9731ae399d67657fe425c687b0265b3c333c1301c03a1bc060959a8b1dde1c7b796e1dd192ecfd864e429550e147d234722cfe6bcaef2e02449f
SSDEEP 24576:12oo60HPdtu1CRiY2eOBvcj3u10EZbKhID6TTHB6Ro3zkZXOTT+9r+H2ymofjWdv:4oa1tKC070EZVuTTnQVO+dI0obyiqQ
TLSH
T1C8952215E790C2B1C0860471F6A2C7F2D8A53DBC96559C837BDD2A7F2E94EC06A71B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4796	D64.tmp

Executes dropped EXE 1 IoCs

pid	Process
4796	D64.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_31001238fafab7e8d52575d3bbab58bf_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D64.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4796	3248	2026-10-02_31001238fafab7e8d52575d3bbab58bf_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-02_31001238fafab7e8d52575d3bbab58bf_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_31001238fafab7e8d52575d3bbab58bf_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\D64.tmp
  "C:\Users\Admin\AppData\Local\Temp\D64.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-02_31001238fafab7e8d52575d3bbab58bf_amadey_elex_smoke-loader.exe 74B5CC6424515128ED189A252059410CA8EE7051ECCDF14C32034175FD115030A3E0F831A9B9AA22B52C3E2AE383AA952C5AEF88F2B8E6336DEB49D7D3F82F05
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D64.tmp

Path C:\Users\Admin\AppData\Local\Temp\D64.tmp
Size 1.9MB
SHA256 f9783673c23c01573ba698f7b5d9727722d945ab9c08ac35c73be2d1fe773768
MD5 98ecd5d164c1762ed884f92212f12c7e
SHA1 f5b5f081e5472873a616c0e91a76688f53f28b4a
SHA512 c44821f0c6de3f0817f8f50edec70f811ada9808a2725ce2a288399836dcf09eb239b2a08d6ef70e25bfecfa0d5b5c07e2b33cf08de8deaa032bffb80587d82a
SSDEEP 49152:4oa1tKC070ENd+0A4pdJ65PkLk425xSJv:4oa1tKC0bdHTCCk42/y
TLSH
T157952250F6D1C1B6C0820631A6A2C7E6D9753E7C9A819C47BBCC6B6F2D90EC09B31B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3248-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4796-6-0x0000000000400000-0x00000000005E6000-memory.dmp