024b661f688f17cab8ddd8330d544634ee44a8ccf242189584755ddf586f75c0

Analysis

max time kernel
149s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
06/05/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_7f28e19a3524e32a5973f6283c66dc38_amadey_elex_smoke-loader_stop.exe
Size 268KB
Sample260506-sd558sdt4s
SHA256 024b661f688f17cab8ddd8330d544634ee44a8ccf242189584755ddf586f75c0
MD5 7f28e19a3524e32a5973f6283c66dc38
SHA1 ff2e45fed8849846361a4c6b7f673714e0b9be9d
SHA512 e906d03a0254abbb35dd25c6e9ddeeec9a0182d01efbdfb2dd8432a13b8c8a8e08570cdf210c8e70b56f831878d0610f76de4810797310f7e948d94569f326b0
SSDEEP 3072:RfTF26j5Cy1+k4uS2GP1ocWnZNNsEJUEEn6lzkJmKCHlHzsvY+RP:RrM6Nyr5iZDsEJUh6KoFz+Y+R
TLSH
T1C6449E147E10C4B1C48A9A7C5CA2D69522A0FE416F3687873BF57ACF8E333954B3B616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4472	wjnpdxuv.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_7f28e19a3524e32a5973f6283c66dc38_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wjnpdxuv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 5212	392	2026-05-06_7f28e19a3524e32a5973f6283c66dc38_amadey_elex_smoke-loader_stop.exe	79
PID 392 wrote to memory of 5212	392	2026-05-06_7f28e19a3524e32a5973f6283c66dc38_amadey_elex_smoke-loader_stop.exe	79
PID 392 wrote to memory of 5212	392	2026-05-06_7f28e19a3524e32a5973f6283c66dc38_amadey_elex_smoke-loader_stop.exe	79
PID 4472 wrote to memory of 3892	4472	wjnpdxuv.exe	82
PID 4472 wrote to memory of 3892	4472	wjnpdxuv.exe	82
PID 4472 wrote to memory of 3892	4472	wjnpdxuv.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-06_7f28e19a3524e32a5973f6283c66dc38_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_7f28e19a3524e32a5973f6283c66dc38_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5212

C:\ProgramData\{F8396C8D-858D-4501-AFE7-8B1E7FC0B6CE}\wjnpdxuv.exe
"C:\ProgramData\{F8396C8D-858D-4501-AFE7-8B1E7FC0B6CE}\wjnpdxuv.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wjnpdxuv.exe

Path C:\ProgramData\{F8396C8D-858D-4501-AFE7-8B1E7FC0B6CE}\wjnpdxuv.exe
Size 268KB
SHA256 9edd040d40da72ff0e77d64fc0f51cd5fbcf254293eb0947deb5981752d45282
MD5 ff741337abb1047b6d5979d4b35f710d
SHA1 993b28dd3e722f6728141801df2a81074b407c0c
SHA512 ce1ab46d48dc9211b36ae8306560a88ff1e40a6e1969e3f9a7a69846faf8e632f747da15a7e45bb10e62d3ab9081f7c8ded3b22b46ff286e3b72b042cfd7b7da
SSDEEP 3072:VfTF26j5Cy1+k4uS2GP1ocWnZNNsEJUEkn6lzkJmKCHlHzsvY+RP:VrM6Nyr5iZDsEJU56KoFz+Y+R
TLSH
T1E4449E147E10C4B1C48A9A7C5CA2D69522A0FE416F3687873BF57ACF8E333954B3B616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/392-0-0x0000000002A70000-0x0000000002A71000-memory.dmp

Download

memory/392-1-0x0000000000330000-0x0000000000384000-memory.dmp

Download

memory/392-7-0x0000000000330000-0x0000000000384000-memory.dmp

Download

memory/3892-16-0x0000000000B30000-0x0000000000B3B000-memory.dmp

Download

memory/4472-14-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/4472-21-0x0000000000060000-0x00000000000B4000-memory.dmp

Download

memory/4472-15-0x0000000000060000-0x00000000000B4000-memory.dmp

Download

memory/5212-2-0x00000000003A0000-0x00000000003AB000-memory.dmp

Download

memory/5212-9-0x00000000003A0000-0x00000000003AB000-memory.dmp

Download

memory/5212-12-0x0000000002920000-0x00000000029A2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads