fd328b0571818ae7c65b73251f403510d44fc05a37ce7d5e0ba507a3358abe40

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_7ecbbc08290930e3df13aa06ed9c28cc_amadey_elex_smoke-loader.exe
Size 2.3MB
Sample260531-g4aapsay8w
SHA256 fd328b0571818ae7c65b73251f403510d44fc05a37ce7d5e0ba507a3358abe40
MD5 7ecbbc08290930e3df13aa06ed9c28cc
SHA1 d4cfefc910180dc8a8b53b90053fd3adf900cc5e
SHA512 c23020fa02434e83eb50da697def9538c93748e9301245882fec4ac12bc5dd86fb83c4f734a6e1eba71cef3572d6b0ed395cb29b17e869448622860fd0a627a2
SSDEEP 24576:h2oo60HPdt+1CRiY2eOBvcj3u10UaUdcc3kAwHSzCcX2sUxBvmt5pTiW0vkvlhRB:Moa1taC070Ua0wHS5GxB2iWsWpTz4
TLSH
T119B50103F35090E2C7954674ED548291AB26F869ABF24AA3794C231ECF537C5BF22F25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
556	10E3.tmp

Executes dropped EXE 1 IoCs

pid	Process
556	10E3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_7ecbbc08290930e3df13aa06ed9c28cc_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10E3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 556	1028	2026-05-31_7ecbbc08290930e3df13aa06ed9c28cc_amadey_elex_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-31_7ecbbc08290930e3df13aa06ed9c28cc_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_7ecbbc08290930e3df13aa06ed9c28cc_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\10E3.tmp
  "C:\Users\Admin\AppData\Local\Temp\10E3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-31_7ecbbc08290930e3df13aa06ed9c28cc_amadey_elex_smoke-loader.exe 1A36A4A5FEFE67187DB638D67AC57A428BD3D4863BA98E991F6713CE84CFAE043C3E3BF4E7F3C4A8AA75EFD9263F5E4DCB47694BB0FC1AD6C98095674DF75082
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\10E3.tmp
Size 2.3MB
SHA256 6fa1e9a59c919f79589b5be278fd7f102e3d9562cec0002312048f3807268cee
MD5 a3409fce15f21947d911ed6c6bcf99ea
SHA1 0cd7dd94b9151efdc90a7312c6e19d45e3cd4622
SHA512 0e40f98a651bfdec533063cf5f6f71936da45bf3a633f5eb9ba565be69fb04bb5a0c69eb32bd1d741de5d3ce1b841609a8c66771f1e7f28c779a13c5557390bc
SSDEEP 24576:h2oo60HPdt+1CRiY2eOBvcj3u10U2ayM0IyzOiVBaf1XA6oGEnnKa9+YBgnBqIC1:Moa1taC070UBy5BE91End+YBgnwInU8
TLSH
T14DB5F103F35094E2C7950674ED5082929B26F8696BF34AA3798C531ECF537C5BF22B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download