7dca9a06ac7be1000b64529b0871218e276d4120da1f56b1c7492d6e125a6055

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_e46a93d5aba5cef1a1f64e87e62839b5_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260507-qa82lset8s
SHA256 7dca9a06ac7be1000b64529b0871218e276d4120da1f56b1c7492d6e125a6055
MD5 e46a93d5aba5cef1a1f64e87e62839b5
SHA1 c3460bfe4905bde142cc4203415fd7eb08bbfb25
SHA512 615379290c732cbc244091a49c1080ba7e290698684a4270dc9690509332c094346f6645000f7e0fa5399ba80a15d54d83160762a970aaba6ecfedebf9b8a8fc
SSDEEP 49152:Qoa1taC070dKB7uaFXpKOSk4DziRgQXvCzFcY:Qoa1taC0b999bSxDziRozFcY
TLSH
T14B952215F384C2F2C0950A70E681C7E698753EBD66519D83BBC81E3F2DA0EC06A75B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5336	7B0C.tmp

Executes dropped EXE 1 IoCs

pid	Process
5336	7B0C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_e46a93d5aba5cef1a1f64e87e62839b5_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7B0C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 5336	2304	2026-05-07_e46a93d5aba5cef1a1f64e87e62839b5_amadey_elex_smoke-loader.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-07_e46a93d5aba5cef1a1f64e87e62839b5_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_e46a93d5aba5cef1a1f64e87e62839b5_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\7B0C.tmp
  "C:\Users\Admin\AppData\Local\Temp\7B0C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-07_e46a93d5aba5cef1a1f64e87e62839b5_amadey_elex_smoke-loader.exe FF4A7ADD512BC24794F1AF26EF61D79638A0DB5AE631FFF637EB4536FF3E24A65A4B9E813FD4305DD08F675D3352BF6B3C6B6B2668B7078A8CD21589625126E9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7B0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B0C.tmp
Size 1.9MB
SHA256 1b25b151781a79b6f7979ec08056355bdcea2767a149cdd095d418ff49f90c84
MD5 d2723e6c739b9dffce5a5b9ad103cc5a
SHA1 f26e1d6c578bb8f8c292404d0b480001daf6b225
SHA512 ec13817d8e4742383112b29800a05f3d40cf82befe00d2c4ecdf62710c6d449d1c210805273d07be34aaebecc945cfdecaacea6b4a7b697857c2b96fd0a2147d
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dK6O25+oSQXtJG64GwmUmJc6Rrh0GzZVcgAyO:Qoa1taC070dbOchxJzddfxPVvAv1
TLSH
T143952214F694C1B6C0D116B1A650C3A3D8B93D78A7469D83BBCC5B3F6890EC06E36B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2304-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5336-5-0x0000000000400000-0x00000000005E6000-memory.dmp