dac1c3075882cc0275a159f5a49eb1578b04afc48cf8c9f0954ab656a9b47bf9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_4b65046b465ee6be3f0d32ab6c70f11b_amadey_elex_smoke-loader.exe
Size 3.2MB
Sample260423-cfccyaf16v
SHA256 dac1c3075882cc0275a159f5a49eb1578b04afc48cf8c9f0954ab656a9b47bf9
MD5 4b65046b465ee6be3f0d32ab6c70f11b
SHA1 19d3a389a3b8575ea9c453bcc2f4338034446ae1
SHA512 a87da50e21160927a09d095907dc7207ee7acca1651bdf9f68eaf782075b2ed704e78344490ae0f35f89172af01dbd95d9eeab01e33e6cf634dd95a9b59a27c9
SSDEEP 98304:amSWOiIyUBdPColdlQR430PHWz5VLUjH5oxFbx:aXP97Ie0fWz5VUjZEd
TLSH
T122F523017761E1F3D15226F4B89287D3E5312CB4BF211AC73EC8231D9C65AD8AB9BB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4352	1EED.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_4b65046b465ee6be3f0d32ab6c70f11b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1EED.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4352	1960	2026-04-23_4b65046b465ee6be3f0d32ab6c70f11b_amadey_elex_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-23_4b65046b465ee6be3f0d32ab6c70f11b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_4b65046b465ee6be3f0d32ab6c70f11b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\1EED.tmp
  "C:\Users\Admin\AppData\Local\Temp\1EED.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-04-23_4b65046b465ee6be3f0d32ab6c70f11b_amadey_elex_smoke-loader.exe A905C775324516EE43372887D76F77085338E06742E9A5AEF14F2A543DF9C4C1CA3F2F07B801E8EA12AE74927FDFB0025C9267EAE0A691586030B93C53281F8B
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1EED.tmp

Path C:\Users\Admin\AppData\Local\Temp\1EED.tmp
Size 3.2MB
SHA256 d2e0c4445757780dbd86e5080eabf1e4ccf410c48db86856e0b1ac2c569c432b
MD5 9e8e4e389a2be99d4e3c6fff2570150d
SHA1 c0b7d8375a862c46c31fc36c33e731c1c4704fd8
SHA512 89d7ecb9cb5922ecc734c472b4db9d18d88722e0f3592c9fcf4292d2fdc6f4c4526bb32be2ca76fa7405e74a9e4fc7c2ccc5cb2973a80d94363ce8f24534119d
SSDEEP 49152:Gvm22OdWOXqrbIyUJV7S6Cr4dz6AEOnPucpS+d3SZQzwLVT5kUvgJSgHT6ojkxFN:amSWOiIyUi6ENunPg+gVLUjH5oxFbx
TLSH
T103F523017765A1F3D11226F4B85247D296313CB4BB604BD73EC8235E8C66BE8AFA7712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download