af9655bab21155dc8dfe4b140f0180fa14932ee1f1ba8e64828f9d1fa3d44612

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe
Size 5.7MB
Sample260426-e1q3yafs8k
SHA256 af9655bab21155dc8dfe4b140f0180fa14932ee1f1ba8e64828f9d1fa3d44612
MD5 80229f7e5f509d1fcb26363a7f73b54d
SHA1 c0342236fe8caebcb4e4d38dd1d0c2435385767a
SHA512 840e9cc05d25f9949fe85a7b89e9ed6f242d2241b045db450a3dba43006d76c277ede8557b33b3d5a65141c4cc1eed5839d151182358fdcaff8cb18cc7dc9f62
SSDEEP 98304:Qoa1taC0uNgC7sLlGcVpjGcVpjGcVpjGcVpjGcVp:Qoa3qCglJTJTJTJTJ
TLSH
T16E568D1233F85A2AF0FF07B5783546904BF5F9512AA2DB1F19A16ADE1CA37418E52333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5000	1BB1.tmp

Executes dropped EXE 1 IoCs

pid	Process
5000	1BB1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1BB1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 5000	4484	2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\1BB1.tmp
  "C:\Users\Admin\AppData\Local\Temp\1BB1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe 8B8844A14AD7C7F32DF8620FF7DAE306C435FD52609EA7A01BDC19321AA796664C338A5624BBB1267D0B36FB34C5EFF56549F2DE8E950DBDD90BF571F56FC474
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1BB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\1BB1.tmp
Size 5.7MB
SHA256 32997b8ab26e25daf840c7e8044c5af1a5263f4ab7aff34822a617224494d079
MD5 5db666db9f09a9972cc2ea959745c6f4
SHA1 06d93a9fd0a13974839a29645e28b1c1ea86fb1e
SHA512 a6782d78b496294048a847fa6e0339f3bca061f8e3f5f3dc99a408a5791feefd9b1198b27a7d4677d892e44f371854e5a1ea3c211e2e14de95f73a96a3024b49
SSDEEP 98304:Qoa1taC0JK3UyBVWpjiIGwLcBGcVpjGcVpjGcVpjGcVpjGcVp:Qoa3mK3FBIjiIGhJTJTJTJTJ
TLSH
T1B8568D1233F85A2AF0FF07B5783546904BF6F9512AA2DB5F19A06ADE1CA37418D52333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4484-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5000-5-0x0000000000400000-0x00000000005E6000-memory.dmp