4d4076a084e8cd36035546a12713800ecdaffc5c36e58d1f4c116c80841999c3

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_8658e59e9c7b13f3f5afb7d0e6c60b78_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260504-ejblxsfx5k
SHA256 4d4076a084e8cd36035546a12713800ecdaffc5c36e58d1f4c116c80841999c3
MD5 8658e59e9c7b13f3f5afb7d0e6c60b78
SHA1 94f33089b6627568e41420fbc523ffc58d375f6b
SHA512 14456306c025b035dd4fbbe7d8a459630b082a36591926049c3d3c0a343c6007d5ae11cb0e851eebead1bd5e8d75240ea68ace7959f4d6ec9ce204028151a5bd
SSDEEP 98304:Emhd1UryehvzL4lXCTex1a4O7VLUjH5oxFbxCVLUjH5oxFbx:ElB7L4lSTex5eVUjZEdCVUjZEd
TLSH
T1B3262340FBE4C261D1C275F9648343DADA783F3D4565D94F6FCE2A1EEC688E26278242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
6024	105.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_8658e59e9c7b13f3f5afb7d0e6c60b78_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	105.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 6024	3424	2026-05-04_8658e59e9c7b13f3f5afb7d0e6c60b78_amadey_elex_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-04_8658e59e9c7b13f3f5afb7d0e6c60b78_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_8658e59e9c7b13f3f5afb7d0e6c60b78_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\105.tmp
  "C:\Users\Admin\AppData\Local\Temp\105.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-04_8658e59e9c7b13f3f5afb7d0e6c60b78_amadey_elex_smoke-loader.exe 2D814AC544A652330F4666482C30D7552E95B2F476CCD95291937F4621E4D06C44CA7102373CC7869BCDC04EC4ACA9C60A9BC3208A9F4D0585CFA0F598DFDCE2
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

105.tmp

Path C:\Users\Admin\AppData\Local\Temp\105.tmp
Size 4.2MB
SHA256 3ed792f50086fd5aa099d5206cf32841ae6360f8476891e36a9059938c25576a
MD5 366049f94773425bb218299e832f9155
SHA1 e56add781e843312e2d9e577f7df12a673247943
SHA512 12cecbdf2c36994a30ffc23534bea33b75250ec66b426570b37d51822025a8133b8232b91376f3aaa4a8f230b43613d354436b8be77c6558de0497ecc87e078f
SSDEEP 98304:Emhd1UryeOlPxbxf1o3vVLUjH5oxFbxCVLUjH5oxFbx:Elu5xbxf1+VUjZEdCVUjZEd
TLSH
T144262380B7D5C272C1C274F9649347DED9343F6C52759A8B2FCA2A1DECB89E27274242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3424-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6024-5-0x0000000000400000-0x0000000000849000-memory.dmp