87150a54be68278ef885ff7d3c5c88e87b59841ddb86f6d5fac0b368156a1750

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_9ec74fbde515de2991c1f002dbc6dc60_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260606-gap43abt9p
SHA256 87150a54be68278ef885ff7d3c5c88e87b59841ddb86f6d5fac0b368156a1750
MD5 9ec74fbde515de2991c1f002dbc6dc60
SHA1 2a81aa4ab21a6d4923f19582d946a23dcc90d339
SHA512 0837c0efe64c65026b49db8e6e37f6d6fe9bad0f93dc9dfd5d3de5a15e52eae38f72f16f95bd74ca5ccb14816cd166561f5a79a7506e588ca5f32f8bfbf564cd
SSDEEP 49152:Qoa1taC070dvzZi/7zuBH8J5hty0pSJ+QleqMvD8d:Qoa1taC0+AX2HiE0pSJZMv4d
TLSH
T152952210F394C2F2D0960534A6A1C7E2D8783E7D6A455D83BFDD1B6F29A0FD09A6270B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3420	2248.tmp

Executes dropped EXE 1 IoCs

pid	Process
3420	2248.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_9ec74fbde515de2991c1f002dbc6dc60_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2248.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 3420	1948	2026-06-06_9ec74fbde515de2991c1f002dbc6dc60_amadey_elex_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-06_9ec74fbde515de2991c1f002dbc6dc60_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_9ec74fbde515de2991c1f002dbc6dc60_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\2248.tmp
  "C:\Users\Admin\AppData\Local\Temp\2248.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-06_9ec74fbde515de2991c1f002dbc6dc60_amadey_elex_smoke-loader.exe 80E507ADCC091BC404F4347045974385C53151247090BD16EC3DB99D9DE756771CAE39E08257E1E4AEC49364B967CA5E399164C496D3655AF85D1B2C3FDF4F56
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2248.tmp

Path C:\Users\Admin\AppData\Local\Temp\2248.tmp
Size 1.9MB
SHA256 1f174c3ccd03635a36c532b980fbef13153b49e45247132f23fce14f4cbb8245
MD5 98a2077dfb307dd98a6d88e9b6e0e141
SHA1 78b3cb57fff8aee355ae3de49add42a32cc858db
SHA512 0d6fda2796f116d22feb19b59a32dd54614cbdca9796618b0b9cf28cb5ca60499cd2f2ec183420b9bd25937c9996684a17b6ce948f1788b97e03ef389f35fd29
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d+8gznNk3JWE/d5RjWO8/QQmZ5En9VYOD8QyV:Qoa1taC070d+PC/dxEVhnWK8Ee
TLSH
T1E4952261F780C2B5C4950530E293C3E298AA3E7D57419D837BCD1E7F1AA0EC0AB66B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3420-5-0x0000000000400000-0x00000000005E6000-memory.dmp