b5615aae4fe0c053f19f4c2a2d477ee74706c0043cc146f1f24b20c94629c2e2

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_3444e061b77de7b2f527b98175040e28_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260507-ltdycsaz41
SHA256 b5615aae4fe0c053f19f4c2a2d477ee74706c0043cc146f1f24b20c94629c2e2
MD5 3444e061b77de7b2f527b98175040e28
SHA1 559946e885dbe21673ea40288a387d2b6219d309
SHA512 1e76fd38036224214eef53e21be4a79f00c86eef6a9607e674d3732b68081595eb68eadfec7fe5f6bfdfc309ccb22b2798db60e1737cc728400c9de465c17373
SSDEEP 49152:Voa1taC070dhydddo+GIFXZTQExolOWf/BYGu5qo7:Voa1taC01dddZGeX2ExolOW6Gu517
TLSH
T1D6952351FBD1D2B2D09109B1D5A1C7E298B53D3C9A418E437FC95F3F29A0EC06632A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3676	E7EF.tmp

Executes dropped EXE 1 IoCs

pid	Process
3676	E7EF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_3444e061b77de7b2f527b98175040e28_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E7EF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3676	3372	2026-05-07_3444e061b77de7b2f527b98175040e28_amadey_elex_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-07_3444e061b77de7b2f527b98175040e28_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_3444e061b77de7b2f527b98175040e28_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\AppData\Local\Temp\E7EF.tmp
  "C:\Users\Admin\AppData\Local\Temp\E7EF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-07_3444e061b77de7b2f527b98175040e28_amadey_elex_smoke-loader.exe 09D7D9A6ED2B9F43064C45D33ECDC752FD232223AA21A02B43A8C19425BCCE6CD313484AB2EE65966A45F6BF82C4E2856B8B3F301C790F5B235B076B69E88B3A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E7EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\E7EF.tmp
Size 1.9MB
SHA256 d23ad0d5ee59057c0a30bd18e617beab8f4e490a5a7501631a8135a7914cdfc7
MD5 08ddf7fe4dd70d33be4c2e2622f9ea69
SHA1 a4e5b982a7c26fda0c279216d707bc0e54cc93ef
SHA512 4ac51bc04787bfd46076ae01ed96714fe32834a61afcefddf5de9846b7245cf47d277792bbc4b1f828041b97f6aa381baaca912311aab7014637c5e93dbdeff3
SSDEEP 49152:Voa1taC070d3AJZ5VzT9OD6iOcwdaksTq6FU01mW:Voa1taC08CvzTItOTUFG01mW
TLSH
T182952240FBD1D2F1C0810675B662C7FAC8A93E7816558C877FC81F6F29A5AC0AA72747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3372-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3676-5-0x0000000000400000-0x00000000005E6000-memory.dmp