50d41a2aecd5c5b627f7bfbfd2d336b723eca9fc87a7dc94f3e023a502e4a14e

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-21_8453498a278434f50cea7e73c50a0079_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261022-xt8nhstves
SHA256 50d41a2aecd5c5b627f7bfbfd2d336b723eca9fc87a7dc94f3e023a502e4a14e
MD5 8453498a278434f50cea7e73c50a0079
SHA1 0db25793d4c10dd99d33425d3877240786767a40
SHA512 1638350a5b812acb5c19952be910ad0b1415f4af95100875000e5138419d03467c0d18ee304dea3a8e73b95089fb1abcb2069834baa9b831ea33cceb65835086
SSDEEP 49152:eoa1taC070UOgQSWDU6vT02wKkH0tZLVNeC73x+7:eoa1taC0RQSKUwpLvLVNN7B
TLSH
T1329522A1EB95D2B6C0910A72A591C3E3EC613D7C97449C837FCC5A3F29A0EC46B62753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2764	F6AF.tmp

Executes dropped EXE 1 IoCs

pid	Process
2764	F6AF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-21_8453498a278434f50cea7e73c50a0079_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F6AF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 2764	4904	2026-10-21_8453498a278434f50cea7e73c50a0079_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-21_8453498a278434f50cea7e73c50a0079_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-21_8453498a278434f50cea7e73c50a0079_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\F6AF.tmp
  "C:\Users\Admin\AppData\Local\Temp\F6AF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-21_8453498a278434f50cea7e73c50a0079_amadey_elex_smoke-loader.exe 01A2A35940C45429F9D18E2746568419582DACF17B46574F3163D175F253E405AF18275EA69065701BCAEA64CA874031EBAB2B3F16C77F170C9676EA2E588C2C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F6AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6AF.tmp
Size 1.9MB
SHA256 d8e7843f6d73ac6fefe67814d55a6d4ed12b389c5f0832d20e183a9c4056b14e
MD5 95d1c20e4b59a6c68fe20aa4007eb09a
SHA1 6bdb9c375cdc657162fc9af93623a62a1ad65a5f
SHA512 8b7c63298670649c41cd6ea4f67287b89f6374ba61cf61d5ffa3b956043a7e8c63ffb4b9a49c6d8fb546c2d177afef4bd0c109f02e72662a810a262fb28381b1
SSDEEP 49152:eoa1taC070ULPt/GrcSA+wWvooEHs8ju:eoa1taC0BlxFkQLs
TLSH
T10A952351F394C0B2C0820A759463C7E6AC693E3C9B595DC36BDC1B6F1EA4EC09A32B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2764-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4904-0-0x0000000000400000-0x00000000005EB000-memory.dmp