6378d02b547d1683b33a7a1c93772d367a507e5af466fb23bb9daeae346ebff7

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_f52b18bfea7b8404b6656dee8aefa29c_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260629-bpd3fsbs9j
SHA256 6378d02b547d1683b33a7a1c93772d367a507e5af466fb23bb9daeae346ebff7
MD5 f52b18bfea7b8404b6656dee8aefa29c
SHA1 6ec7a0627461e6c68fbed3a1c3ea2cdd3aeba395
SHA512 2659fe0fcda27a956c10594995a72a96a2a34fdd09668128cd6c67c3ac22b35aac909a32cebe939350cf76034787676b3032d800de17aea51da7fd0765e813bf
SSDEEP 49152:Qoa1taC070dzrWkuNCvKJ2IE0CG0weTniJEfz:Qoa1taC0yrWfXk8CV9GJEfz
TLSH
T1B2952224F795C2B6C0810AB5B54283E3DCB92E7C87529C837ADC1E6F2994EC06772B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
7064	7FAB.tmp

Executes dropped EXE 1 IoCs

pid	Process
7064	7FAB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_f52b18bfea7b8404b6656dee8aefa29c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7FAB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 7064	4736	2026-06-27_f52b18bfea7b8404b6656dee8aefa29c_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_f52b18bfea7b8404b6656dee8aefa29c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_f52b18bfea7b8404b6656dee8aefa29c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\7FAB.tmp
  "C:\Users\Admin\AppData\Local\Temp\7FAB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-27_f52b18bfea7b8404b6656dee8aefa29c_amadey_elex_smoke-loader.exe 127934C6E3D2E025CAF6DCBE8F86865B2725152B833E974654A49A42167120DB9C0D214DBD671E54835355B7B6867A3679541ECF7FCD21F1C45C2750BAC40451
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7FAB.tmp

Path C:\Users\Admin\AppData\Local\Temp\7FAB.tmp
Size 1.9MB
SHA256 73e3d4eabfd26c12bace20253aa9636163551f0301fb3dddb06f54e91035ce37
MD5 0f60239a8ac682fd4ce48522b288e154
SHA1 576ef646fe2ca44653b3927ad9cca7def4e7b26a
SHA512 7d6097dbb9252908d702c3d5eed6be5ad458af12d620f5515150fca6eb1348e778dd314a993bc210b90830d72e10fc57631d34fab854c7f72c1fe47f6d3e2a7c
SSDEEP 49152:Qoa1taC070dmjxuXFOaG82Rx9liEQJzkRTwteO:Qoa1taC0xuXFjpk3QJzRh
TLSH
T16B952360F394C2B6D0810A75B992C3F298653E7C5A419DC77BC81F2F2D64EC06A72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4736-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/7064-6-0x0000000000400000-0x00000000005E6000-memory.dmp