378d048dffc9320e0f382636d370f4251f67cad6a654489f167b99cff873f824

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_66cdba4552673ae6bf588a4bd5780f9b_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261104-w2n4eaey4j
SHA256 378d048dffc9320e0f382636d370f4251f67cad6a654489f167b99cff873f824
MD5 66cdba4552673ae6bf588a4bd5780f9b
SHA1 f5f83dfa8e1be2b916530a1aff95eaea54db4303
SHA512 ec234d96fd86b31abf5528b516bb2f2d367f519d1126acf66bfa4ef6a843576cb25ae6f68ef78aa63413c639929253cf9777a4b6f495af5016b53e7958a8d539
SSDEEP 24576:S2oo60HPdt+1CRiY2eOBvcj3u10UWqGfltDBoQs1iY0XPEZkE6aTIHzu6y3Vw:boa1taC070UDcltDyzcO6JTYu
TLSH
T1F8952210F798C2F2C0950A75A181C7F698A53E7C56458C87BFCC1B6F2AE4FC06A66763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2012	93D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2012	93D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_66cdba4552673ae6bf588a4bd5780f9b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 2012	3872	2026-11-03_66cdba4552673ae6bf588a4bd5780f9b_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-03_66cdba4552673ae6bf588a4bd5780f9b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_66cdba4552673ae6bf588a4bd5780f9b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\93D.tmp
  "C:\Users\Admin\AppData\Local\Temp\93D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-11-03_66cdba4552673ae6bf588a4bd5780f9b_amadey_elex_smoke-loader.exe 4FFC3F9CB89E9943744CEA7A6E143CE4C6BDB86B9C45BE9ED0884CDD5716933581090A0D85137BE5C04FEF5F0C55CBC370B7D5276E3EB8703482DD486D83444E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

93D.tmp

Path C:\Users\Admin\AppData\Local\Temp\93D.tmp
Size 1.9MB
SHA256 15b41fc778e21b117552f78f40144a0789036d152dd0af2248ae92b4481603cd
MD5 fb577ac1242df6a0182456e6d826840a
SHA1 569424d6057c76302cb6604f29ed56ff3ed902c1
SHA512 ca34c6ce84b6c377c602314e6c4f7e8100cba2c116140e48a07498eba4a5187f172fe3ec31ac1768cf1152d3b4758ef7dc681964e07fc037aacad3e74e22dc66
SSDEEP 49152:boa1taC070UVCX6mhYCqvtWD56JxOLAchQzlXL:boa1taC0bCKmJmtrwA8+lXL
TLSH
T18C951250F791C2B2D0820674E65287E7E8653EBC1B018CC77FDD2A7E2894EC46A7674B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2012-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3872-0-0x0000000000400000-0x00000000005EB000-memory.dmp