6224f62ea74e438fc2cd336f5b4c79aab47e39771f19d1642210273483736e2d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_5ecf2c1133f10e98f8c85fbfd1e82275_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260606-2cc8hadv5x
SHA256 6224f62ea74e438fc2cd336f5b4c79aab47e39771f19d1642210273483736e2d
MD5 5ecf2c1133f10e98f8c85fbfd1e82275
SHA1 2c44aea9176606ed2121bf4fd93975a9184b412c
SHA512 32d3edd8905dbb24a4b6513f42293995c1a987bed612573b1e82588b54cc2750ccfb3c6c1206ddab37950106181e79026b79659a707d214e8f11d670060f08ec
SSDEEP 49152:Qoa1taC070drZEAUG1/3ki5dQS/JkXd+G9hiNfLV4:Qoa1taC0AZXt/3kICSXGfw4
TLSH
T14B952394FB8AC2B2D4810571A662C7E6EC782E7947519D437FCC1A3F2C90EC4A632B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2900	4E88.tmp

Executes dropped EXE 1 IoCs

pid	Process
2900	4E88.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_5ecf2c1133f10e98f8c85fbfd1e82275_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E88.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2900	2452	2026-06-06_5ecf2c1133f10e98f8c85fbfd1e82275_amadey_elex_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-06_5ecf2c1133f10e98f8c85fbfd1e82275_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_5ecf2c1133f10e98f8c85fbfd1e82275_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\4E88.tmp
  "C:\Users\Admin\AppData\Local\Temp\4E88.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-06_5ecf2c1133f10e98f8c85fbfd1e82275_amadey_elex_smoke-loader.exe EE5F3CCCA4549F560871FBCA6627D47259440CB7A47E21E52E9EBF1552B8E67B4F1BC9FADEAF38A17E8610220B37FB2FAB60348DA4AD5A51932C29BBCD6D022C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E88.tmp

Path C:\Users\Admin\AppData\Local\Temp\4E88.tmp
Size 1.9MB
SHA256 bc1ab780dee34e3cb4425633294c029b01f67b12235fda23693a1278985f2412
MD5 8510d6b1d1bfce8edb37cdca6b7f35a5
SHA1 219b85320dab2b3f16fd660bdfaa4441c45c4e18
SHA512 fa16ac25f3afa7c19d10a7c3048425b506c9ea0fdfeaa83a4e754131271235bb49bef53ac804245e4afb2038579e53732c028b1af4170b5003354b1dcafad772
SSDEEP 49152:Qoa1taC070dMJRVShLLjuDz73sgSxsgqyZnqN:Qoa1taC0jmLj+Ksg5ZU
TLSH
T1A5952254F695C2B6C0810671A6A2C7F6DCB93E7926418D837FCD0B6F1CA0FC56A72B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2452-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2900-5-0x0000000000400000-0x00000000005E6000-memory.dmp