4267345f1f925177aaa0fa2b254cb218f9008f9b8e137bc8e333b87a985c15bb

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_dcf8784b4740fb9bf759fba02e2bd95c_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260603-styq4aby2n
SHA256 4267345f1f925177aaa0fa2b254cb218f9008f9b8e137bc8e333b87a985c15bb
MD5 dcf8784b4740fb9bf759fba02e2bd95c
SHA1 d71d5ec544300b71771b7b77cac4adaf258f1d3d
SHA512 07878199d7b1366abb624484230d3d793fc7a7d7ed82407a75b46df85791659c4c8ada52153ecd1af508ea0526c5a1d655895e69523fc8b7aff4a71d13a63d4d
SSDEEP 49152:Fvm22OdWOXqrbIyUJGMdRFdnll7pC7l3HZFNTMvaZuNwLVT5kUvgJSgHT6ojkxFn:5mSWOiIyU7VBll7UxCvOVLUjH5oxFbxx
TLSH
T18CE52380B792C272D18165F9608383E7C9B43E7D05569A873FCD2A1EECA99F17275343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
804	4179.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_dcf8784b4740fb9bf759fba02e2bd95c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4179.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 804	3492	2026-06-03_dcf8784b4740fb9bf759fba02e2bd95c_amadey_elex_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_dcf8784b4740fb9bf759fba02e2bd95c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_dcf8784b4740fb9bf759fba02e2bd95c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\4179.tmp
  "C:\Users\Admin\AppData\Local\Temp\4179.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-03_dcf8784b4740fb9bf759fba02e2bd95c_amadey_elex_smoke-loader.exe 782F10E86F63B30562612BCB70DCB649C88F6D18962C519E60BB6F21ACE57B4AF6446E700D24A84864E11E55AE0E46544E71A00AEEE075F89888C171729032EF
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4179.tmp

Path C:\Users\Admin\AppData\Local\Temp\4179.tmp
Size 3.1MB
SHA256 b1e60f6f5ddb446f33e63dfca4a7f4e0a8edd54453868025cd3d61c1e331e4eb
MD5 7c2ecf314d10330d5d510d8672d7cbe4
SHA1 e2fafcd68906c190a2b5ffb2c666c937de4e99e5
SHA512 7ff9f68bc8b7286286cf53ac9397d67b39529e5f4eefc9daf879b7532fe1774424db3013e83922d98388b3e576adc0aae61cda2da4ed0abf6bf68ecac039467e
SSDEEP 98304:5mSWOiIyUxbMVu/uUaapAkx/ZjgVLUjH5oxFbxx:5XvbcuWiP/GVUjZEdx
TLSH
T100E52381B781C272D08265F9648343DBC9343E7D66668D8B3FCD1B2EEC689F1A674643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/804-5-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/3492-0-0x0000000000400000-0x000000000071F000-memory.dmp