f93d3a6b811a78a58a85dfbc2236b5bb30855c347a38181c736859e326dd9dc9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_473b1997fda865a8685e9cd544c04fff_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261014-18aa2stsdy
SHA256 f93d3a6b811a78a58a85dfbc2236b5bb30855c347a38181c736859e326dd9dc9
MD5 473b1997fda865a8685e9cd544c04fff
SHA1 f133c4e596ff45ac1afa6688cef09d377499ba0e
SHA512 8c5d5b4490ef64d0daac0b68a91e9baafa2dc0f1f47630a7431823f6b08c1d324264508a569d3bfa15ecd18a2bff7256844fc6cc63456729d9ed8176f2fe9bdc
SSDEEP 49152:Qoa1taC070dbnp+ouuP2ZCsmPcLfEGK8u:Qoa1taC0Up+k2mkLfbu
TLSH
T141952350F395D2B1C0900671B292C7E3EC693E7CAA459D437BC81B3F2994FD42AA2B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3304	231E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3304	231E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_473b1997fda865a8685e9cd544c04fff_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	231E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3304	2200	2026-10-14_473b1997fda865a8685e9cd544c04fff_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-14_473b1997fda865a8685e9cd544c04fff_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_473b1997fda865a8685e9cd544c04fff_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\231E.tmp
  "C:\Users\Admin\AppData\Local\Temp\231E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-14_473b1997fda865a8685e9cd544c04fff_amadey_elex_smoke-loader.exe E8953AC63A1881EF39A08E5AFDEA557EF0F852232837CEC8BD62268E48CA3936FC4E7470460608BF5F6527893F35801ED0E2F58F83DB81AA01A95F6CA52D23A1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

231E.tmp

Path C:\Users\Admin\AppData\Local\Temp\231E.tmp
Size 1.9MB
SHA256 239c423111dd6fe9edbdf3575fe65b5ee9c6ae7de80f498af52b485bd6a44b15
MD5 b08123e1ca9ee9ccca01ce838e79c03b
SHA1 c7dd2b1c2c6a3f308d1d011ab5c6e5148e371b9f
SHA512 8fa8b2a9715941902dcfb9f7bbfcce13be4261ac7e596951c018ebbb6aac90b6e56268dad7b674c12907e0fbbc78fdba064e97038efa80dfba11258531f45ec7
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dl+U0tZajLNQ2ROKjcFrL1vy5AVllK4FCivSU:Qoa1taC070dL0Xa3SRw6VllK4F7anW3
TLSH
T143952252FB95C2B2C0850A35A692C7F3DCB52D7C56419C833BD80B3F6EA0EC46A71A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2200-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3304-6-0x0000000000400000-0x00000000005E6000-memory.dmp