0a28093e6dd6c076f027f9a646addab444b87388fef48c5e7d3402c2fb6e6b84

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_ab2ea63e6043c1f75d8b1da7998b60dd_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260531-gal3eah19w
SHA256 0a28093e6dd6c076f027f9a646addab444b87388fef48c5e7d3402c2fb6e6b84
MD5 ab2ea63e6043c1f75d8b1da7998b60dd
SHA1 72c099f6699576c520ece5e05f51615350be730e
SHA512 254600318f4c467241a412eb37cfcfca32f71e67b8eb8c32bed41dcaf4ee9c761731d56ee63efaa99b109d5673a4783540ee3a3c1ce5eb01bece37e42fd6bc4a
SSDEEP 98304:emhd1UryedTEPcHnZo+1rAnV7wQqZUha5jtSn:el22W+Bi2QbaZte
TLSH
T19D26D00996FCDA2CCC1F51F4A1A51145C7F0A524EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1344	1D09.tmp

Executes dropped EXE 1 IoCs

pid	Process
1344	1D09.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_ab2ea63e6043c1f75d8b1da7998b60dd_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D09.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 1344	4520	2026-05-31_ab2ea63e6043c1f75d8b1da7998b60dd_amadey_elex_smoke-loader.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-31_ab2ea63e6043c1f75d8b1da7998b60dd_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_ab2ea63e6043c1f75d8b1da7998b60dd_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Users\Admin\AppData\Local\Temp\1D09.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D09.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-31_ab2ea63e6043c1f75d8b1da7998b60dd_amadey_elex_smoke-loader.exe 677327DFE4AFF37C95706235D4CDCB6818C1CE48614161ABFE05695E2D1744E45285C9B7E6F28AF2CD75EFA195DD3BE5CCFDEA1D8E2F654D81C93F4511A1F133
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1D09.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D09.tmp
Size 4.4MB
SHA256 ea72072b4e4976df0003fdf8c99f532a11c16c25802db7154c3e0dc7af1efd7e
MD5 173db0539f853608aab673a5d985ec61
SHA1 629fd9966129bdd6027060de1cb76ef68ae600ab
SHA512 95e21ff8d9fe227f0d916ff738db0b3105573f5ac4c6ab888d97d20c65d3ad303b7090339363d5120f5fe48124fd3ef5d38576c36aadc7c85654d96088383373
SSDEEP 98304:emhd1UryeCXnjXcYMOvV7wQqZUha5jtSn:eliXrcYMOv2QbaZte
TLSH
T1C326D00996FCDA2CCC1F51F4A1A51145C7F0A524EBD3AF997DA2F1F02A823A4B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4520-0-0x0000000000400000-0x0000000000849000-memory.dmp