d19d6212b9a5ac410b60d184718b162a9d0d8d24a209ff6711e419f7539ad1a9

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260522-ryznhsd17q
SHA256 d19d6212b9a5ac410b60d184718b162a9d0d8d24a209ff6711e419f7539ad1a9
MD5 109da1839c4a32062bf253a5dd029786
SHA1 de05da9f49e3586cfe389ee74522d71d678bafbd
SHA512 9c684431aa4404733f13be0a1f5fc63babe93029c43f4ebea86c933ec508409feaa23270893155cbc51f2b1e7f3caec9a816aa9cbf222a54f71dddb9c61e6e75
SSDEEP 49152:Qoa1taC070d+rsRe+48y9SCpxkte+c+n0:Qoa1taC0lIRe+48yZHkteu0
TLSH
T11C952215F795D2B3C0820671B696C7E29CB83D3957415C83BBDC1E7F2AA0EC02A76A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2900	4EC7.tmp

Executes dropped EXE 1 IoCs

pid	Process
2900	4EC7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4EC7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2900	2452	2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\4EC7.tmp
  "C:\Users\Admin\AppData\Local\Temp\4EC7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe 3BDD3ECF857E571F558F75FBDD0E1DEB332217620B0ECC33BCF508C6CE2B5942EDD1D1E09CFADAD4F762ED75F9417E967607BDD515F1C3BDCCB01113505B9C35
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4EC7.tmp

Path C:\Users\Admin\AppData\Local\Temp\4EC7.tmp
Size 1.9MB
SHA256 4814d9591dd449c82d6b035548ec7e37f973f1b6fd5fc31dec486238d3746e02
MD5 6e6ed8703b5a7870805c0035f4fa3114
SHA1 939ef26cb550afea3bd2fdaaa3b1f4caf5a30679
SHA512 e98d1e23a31b10319f02b6777ab04929f9fecc98e218a030efd350c8e513055da6068bfeaf81990068abc31aa0115bf8a873a24d1313631d903788d98c6f0365
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dYzx+Z/57S18U0yhMTHy0Uq86JmIXAf2OF9Nt:Qoa1taC070dExbOTHWqNhAf2WxTO/2f
TLSH
T117952221F7D1C2B6C0811A71A651C3E6CD793E7897418D437BC82B7F2964EC06AB279B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2452-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2900-5-0x0000000000400000-0x00000000005E6000-memory.dmp