e9fea182ba8f28bb2a4c7b29ec34d79d9956ad362b72264b8300ad7fcf589990

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_510e5a9c69158e35dc15072ca638e861_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260603-mvhtdads2s
SHA256 e9fea182ba8f28bb2a4c7b29ec34d79d9956ad362b72264b8300ad7fcf589990
MD5 510e5a9c69158e35dc15072ca638e861
SHA1 33f5d086832d6cfccfa4c0abc818867a3645ff79
SHA512 1e6b79132b704b81056aef28c5d7296239ba5b080347a9993a81a070e75f07d04d28ce0ce1b82296ca8aefcc1593b03ca2d5e613c1741739aa0a08ecea9c251a
SSDEEP 49152:Qoa1taC070dY8Y6wgPETmWbOZhJu2jYwScjOVi2:Qoa1taC0LrQPEaW49jYwByVp
TLSH
T132952214F7A5C2B1D0850A72B691C7E7ECA53EBD57028C877BC81B2F29A0DC06971B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4120	27A7.tmp

Executes dropped EXE 1 IoCs

pid	Process
4120	27A7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_510e5a9c69158e35dc15072ca638e861_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27A7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4120	1528	2026-06-03_510e5a9c69158e35dc15072ca638e861_amadey_elex_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_510e5a9c69158e35dc15072ca638e861_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_510e5a9c69158e35dc15072ca638e861_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\27A7.tmp
  "C:\Users\Admin\AppData\Local\Temp\27A7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-03_510e5a9c69158e35dc15072ca638e861_amadey_elex_smoke-loader.exe 87B30C89080B4F4EB8D59E125FBB3DE445ED82E27767BF0E94618B65950E8388CA734F2E779D3732D9BB5DD65AE6C1576D7D6BD7090CA219B2AF59CAA5D7DC83
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

27A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\27A7.tmp
Size 1.9MB
SHA256 756026f45055894da597174896cd8f0cc54b0fbd63ddd6955663dd34b2cd90ba
MD5 bd572a9e3fa45cd29d1380f12982f5f1
SHA1 2483b9dfd8f0a72a4bd614fbaf8736208ba718f0
SHA512 9f0f46946762ed3ebb919652485681c04750728a5f442f27c590c6208d97d4a07573c9d20929a8b64d3ccaa005089808ec60479abe2bf4aee5e7c9594467b973
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dOP1MCCGfbPJI7xVAkIXbqfehcL09zzBxZGyw:Qoa1taC070dOPiCPbP6xKGmEQZRZUl0S
TLSH
T167952260F384C2B2C08106B5A951C7E6ECB63E7D4A468C977FC81F7F2664EC15A36687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1528-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4120-5-0x0000000000400000-0x00000000005E6000-memory.dmp