02d346d4b0729136f506912cb6a961b260cabe02383512993a980d4ec0fb1740

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_64fb10183ad3482895babebcecef43d9_amadey_elex_smoke-loader.exe
Size 3.6MB
Sample261011-pq2rssvt3j
SHA256 02d346d4b0729136f506912cb6a961b260cabe02383512993a980d4ec0fb1740
MD5 64fb10183ad3482895babebcecef43d9
SHA1 499c43d00d1937e28b67c93471e976a2146ed04b
SHA512 09f6681f8a9b8acba04db8d7921c6e3c14d17877a0c9e740a6d62c0c2a66d7411f8658e6d586e6b9c4546d5a186e977acde93a17f1de17dbb0553cd9513125c2
SSDEEP 98304:/mSWOiIyUXPRHbAH9tTyy1V3otRQdqxVLUjH5oxFbx:/XL7AHHTy03MCdqxVUjZEd
TLSH
T122060153F7918AE4C24D45BA6B604285923EFA216A0F53427A8C130DCF937C79F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4780	3C44.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_64fb10183ad3482895babebcecef43d9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3C44.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4780	4140	2026-10-10_64fb10183ad3482895babebcecef43d9_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-10_64fb10183ad3482895babebcecef43d9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_64fb10183ad3482895babebcecef43d9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\3C44.tmp
  "C:\Users\Admin\AppData\Local\Temp\3C44.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-10_64fb10183ad3482895babebcecef43d9_amadey_elex_smoke-loader.exe DACDD15F002C3B8EAC54108C82290ED670604127523EAF2B0B4B5F248EE85F464E76C9A0B0B6D974ADBE74BED144726D0CEF8AEFBDDF9C2EA780F3A411686E56
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3C44.tmp

Path C:\Users\Admin\AppData\Local\Temp\3C44.tmp
Size 3.6MB
SHA256 1e0c4acd94f6e2d55570782efa5f1bbc07a312cef5e291b319f2d04ba0e54c39
MD5 f8de3245ca2801536b6a39cf074ac1ba
SHA1 656194c52c53bfabcce41ac03c7d244d79456011
SHA512 55d1b5ece888d43d520c4b0a919cda7949529f69f835861498ffe9d0e3dc4d9049f227f2701adde4a1e9251280745f9990e3808128e1f32923f05689b58d6beb
SSDEEP 98304:/mSWOiIyUKFbLc30z5OuCVLUjH5oxFbx:/XUbLc34TCVUjZEd
TLSH
T176060153F79186E4C28D45B66B514285963EFA21AA0F63423A8C130DCF937C78F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download