44d98cbd94fc17aee112deca02e9e2fbf8d57595fb573f63073b1dc1dbf77113

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5789c64e86017225c0b950c70e84f509_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260628-2fcq5sfv7x
SHA256 44d98cbd94fc17aee112deca02e9e2fbf8d57595fb573f63073b1dc1dbf77113
MD5 5789c64e86017225c0b950c70e84f509
SHA1 7f8b10a09779e2337b34654c9fdde16e0c9bab02
SHA512 f250839583f645f5017b6256d6fc490258b6dab1aa1283c69d7e6a4c19c976f4e6974463aa1eecd11f3f7bda6b115835ae9adf01a8e808807f38bd95e965cf47
SSDEEP 49152:yoa1taC070UL5l+RTCOHsOqhVBcWOLvdvbL9MBacdvOJFIg:yoa1taC0p6T5sOqLBcDLVvH6QZ
TLSH
T1DAB51206B714B0F3C6115BB0A995DAD3A6216C7B7B419EC36DC8534E0CDA6C8AF13F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2820	3BAC.tmp

Executes dropped EXE 1 IoCs

pid	Process
2820	3BAC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5789c64e86017225c0b950c70e84f509_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3BAC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6872 wrote to memory of 2820	6872	2026-06-28_5789c64e86017225c0b950c70e84f509_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5789c64e86017225c0b950c70e84f509_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5789c64e86017225c0b950c70e84f509_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6872
- C:\Users\Admin\AppData\Local\Temp\3BAC.tmp
  "C:\Users\Admin\AppData\Local\Temp\3BAC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-28_5789c64e86017225c0b950c70e84f509_amadey_elex_smoke-loader.exe 72B1B465A74D061A3DDAB54DC1B80A949E5079B6F226C51DE5DD009D266BDC7BA6EA44300308C7761767CBE4ADCD6414D27A3A0167F917E21577D79222E93DCE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3BAC.tmp

Path C:\Users\Admin\AppData\Local\Temp\3BAC.tmp
Size 2.2MB
SHA256 f54fb587175a09ce450ca46e70bae77d52f916025967eebc86fb54c7b27599fe
MD5 77ff8734b323e08831cdfefc66571572
SHA1 02f559542e5c6a78b1427a4e50e184e079d487b0
SHA512 6c4a4b21f282257466a0e5aab9d3e4bd8fd11913f166fd9f0469f70c59c91f179536073e4a71cfc6e6131bb11b52863fbc37c2c175099c2996052cb98e0a1517
SSDEEP 49152:yoa1taC070UDFWmomoy9vHea9vU8ZycdvOJFIg:yoa1taC0pcPB+vHRM8ZyZ
TLSH
T16BB51205B718B0F3CA155BB0A855DBA3A6616CBB7B459DC36DC0134F0C9BAC8AF13B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download