fa3709a30ec803f754f2cf962a6e7edf95f934c86accdb051e05285dbadccdae

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260423-ecy4msas2v
SHA256 fa3709a30ec803f754f2cf962a6e7edf95f934c86accdb051e05285dbadccdae
MD5 85a54b6c066d547b636f596daf7b5195
SHA1 9c94a5fadf7fbf69dac84f6aadf3bb8bff0d34a5
SHA512 db2df31cbc57be0dd9e88916a76a8481fd1ff11df7ab3b30f28ec1bfe9c740d464186cd9fb30651a9b075c5112b587034699af9852b7674793696e9dbfa2f0ca
SSDEEP 98304:tmhd1UryebfCVITrSm0nVLUjH5oxFbxCVLUjH5oxFbxe:tl7fXrSrnVUjZEdCVUjZEde
TLSH
T1E3262300BB54B4E3C241BEF4648797DB93307E6B3B25A98B1E84231E9CDF5C5AB61B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2740	E2CE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E2CE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 2740	5196	2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Users\Admin\AppData\Local\Temp\E2CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\E2CE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-04-23_85a54b6c066d547b636f596daf7b5195_amadey_elex_smoke-loader.exe F526E6DBC87C815C44D48935A6ECFBB379D4900B4CF5CA9B3EC1840A66B59760166DDE8671524506558D1752384BB141D264F39730867F895FEC33D8C1BE01B4
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\E2CE.tmp
Size 4.4MB
SHA256 36243568370bfb4e5b1b1b13b2d8faf9903987d92fb2567569d87f4ba6f650be
MD5 a57259b5bce65a69d63e54398e499602
SHA1 acb34275693f3783d89cad9190c7b75970013e73
SHA512 0088737138a242fa59ba35d69020550077e1970e2742ede9c8a8fe4868abedb6c40bad35a2adc637fefa0a94fb1f61059f05284e3fbd2a5813cb1ae4fb84f749
SSDEEP 98304:tmhd1Urye6A6TXCiMtJ+suyMNVLUjH5oxFbxCVLUjH5oxFbxe:tlaAVSnVUjZEdCVUjZEde
TLSH
T153262301B714B4F3C251BAF4648793DB92207EAB3B65E98B2DC4230E8CDF5C5AB65B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download