8810e2f8c31a7f0d4a6388d91b7031b2569ffeac2ed4b739f6c469f26c27547e

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_84c8d1b546d6f2619bbbb03082d472da_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260602-vbabwsay7z
SHA256 8810e2f8c31a7f0d4a6388d91b7031b2569ffeac2ed4b739f6c469f26c27547e
MD5 84c8d1b546d6f2619bbbb03082d472da
SHA1 95aca14b05ccc6bd9aaa2b3f2c8cf1a42ecb0236
SHA512 5fadc1c633447c3ac3c842765f5e30cd2a5c45e611d0ce66dad1975b2d5b8dab478fde2fcb2be984fbdfb5a15cbce5f8d8050f359045bd6863fde6cc460a11a6
SSDEEP 98304:5mSWOiIyUWiG1euWBRxboaUCaVLUjH5oxFbxx:5XIgBE/VUjZEdx
TLSH
T19AE52350FBC0C2B2D08169F9609383D6D9713F3D52269D8B3FC92A1FAC689F1B675246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5312	8A2A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_84c8d1b546d6f2619bbbb03082d472da_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8A2A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 5312	5304	2026-06-02_84c8d1b546d6f2619bbbb03082d472da_amadey_elex_smoke-loader.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-06-02_84c8d1b546d6f2619bbbb03082d472da_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_84c8d1b546d6f2619bbbb03082d472da_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Users\Admin\AppData\Local\Temp\8A2A.tmp
  "C:\Users\Admin\AppData\Local\Temp\8A2A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-02_84c8d1b546d6f2619bbbb03082d472da_amadey_elex_smoke-loader.exe 6BD01942DA32821157924F58958C4FBACE354133D3715323E221176642DB57DBA35B337B1CAEDCD52C7D419BABBC362A29B9343A68015BA1C839A7C63312F032
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A2A.tmp

Path C:\Users\Admin\AppData\Local\Temp\8A2A.tmp
Size 3.1MB
SHA256 584fdc505ddf854484f18feaffbd7fdfd48d3b3e8048614409daa57720f1a4b1
MD5 38dd4f74413d7459b1b9e88126aff2ae
SHA1 e2433241bc239e0b77369d3e854a62cf1a0ab38a
SHA512 9ffd4f7597a3718da3aa51642e89562352a8e4bc459ccc5d3e865e239faa97154f0754fbf7c82181eb9d15d8f51abeafad64470b7031ab4d0a7be2b67f26b048
SSDEEP 49152:Fvm22OdWOXqrbIyUJGqFjl6sVzDBA1CM10IMHWm1RbwUuWwLVT5kUvgJSgHT6ojI:5mSWOiIyUbFo6dh26bwlVLUjH5oxFbxx
TLSH
T14AE52351B781C271D0C135F9648383E6C9343FBD5A25DA8B3FCE2A2E9CA89F56275243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5304-0-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5312-5-0x0000000000400000-0x000000000071F000-memory.dmp