69db4d717acee6f3f76434c593283a26cf9d54dc439c0e5a908d4abba81349c5

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_60507b417892628d5955b97c16e4e80f_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261030-d1sq4aws2j
SHA256 69db4d717acee6f3f76434c593283a26cf9d54dc439c0e5a908d4abba81349c5
MD5 60507b417892628d5955b97c16e4e80f
SHA1 7b602f62f4ecc19921287389e0541b61a196c774
SHA512 51d2c9b64753677eba51a7c36342cfdeaf79ed62162a3e9097ddf69872262fc8dd6a47d197d6339a540f5e6a686090e3cf5df6d6c264020d2b140a4860da41c5
SSDEEP 49152:Joa1tHC070U3UZgTy8KC54IrBDptKTIFg5LIR:Joa1tHC0258d54IZx4IR
TLSH
T114952364F795C2F1C0828671D6A2C7B2E9A63E7D9B458D836BC41B2F1C80FD06A35B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2792	458B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2792	458B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_60507b417892628d5955b97c16e4e80f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	458B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5652 wrote to memory of 2792	5652	2026-10-28_60507b417892628d5955b97c16e4e80f_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-28_60507b417892628d5955b97c16e4e80f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_60507b417892628d5955b97c16e4e80f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Users\Admin\AppData\Local\Temp\458B.tmp
  "C:\Users\Admin\AppData\Local\Temp\458B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-28_60507b417892628d5955b97c16e4e80f_amadey_elex_smoke-loader.exe 99A12AD593FFB91754E742CB6EC693DF5A2E35022F1D1D302246C954E6C9CCD0FB451E75115C653E054B3A9F5492C6C226739A9625D7DB370E42AD34986DFA9B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

458B.tmp

Path C:\Users\Admin\AppData\Local\Temp\458B.tmp
Size 1.9MB
SHA256 8887846e9d3eeec9989f627327c1fb98a64e6b94d95a056e2148f733ed03916d
MD5 de074d20800fdf008cf483ee743853e7
SHA1 de4e7c7a8d8dc7a8411c4ac5bbfb23a73720291c
SHA512 291d3cd040120d3a6e4185108340023532e30b9f70fe93b7c2504ec8cbf4ca9dbd59bfec5c5580e56aa9c553ca192adae1638a22caff11d2fe2c5d2758864db5
SSDEEP 24576:82oo60HPdtR1CRiY2eOBvcj3u10U4s1quNqw5uLQTT9bph5p8vRP/92+JzHv67HL:Joa1tHC070UTJq8tXmZPVNNP67HInFg
TLSH
T18E952290E7D4C2B6C0404A72E5A2C796D96A3E7C57558EC37BC81B2F6EA0FC46A35703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2792-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5652-0-0x0000000000400000-0x00000000005E6000-memory.dmp