8f7602ad1679777493e6575308ca4918de79762b64450407d1cf46a12838c542

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_f4e3c4a7eb2894036e9056d0b7435b4b_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260629-bpvefaas7v
SHA256 8f7602ad1679777493e6575308ca4918de79762b64450407d1cf46a12838c542
MD5 f4e3c4a7eb2894036e9056d0b7435b4b
SHA1 bcc3173613abad929e6770169de00cb4d6f751e8
SHA512 2c45d3aff5c8413c730d94ffdc34854ddbb7c8caab383da829fc85a99efa92e8bacca9291b88bac5937060ccec46bb3c8431dbbb675f5e45be71fc817838f20a
SSDEEP 49152:Qoa1taC070dcrT0ijZY2YO6gKah6tdz16:Qoa1taC0zT0i6gXhQdA
TLSH
T114952241F799C2B1C0810971A651C3F69C793C7996519C83BFC92F2F2AB4EC4AB61B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6288	5510.tmp

Executes dropped EXE 1 IoCs

pid	Process
6288	5510.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_f4e3c4a7eb2894036e9056d0b7435b4b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5510.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5544 wrote to memory of 6288	5544	2026-06-27_f4e3c4a7eb2894036e9056d0b7435b4b_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_f4e3c4a7eb2894036e9056d0b7435b4b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_f4e3c4a7eb2894036e9056d0b7435b4b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Users\Admin\AppData\Local\Temp\5510.tmp
  "C:\Users\Admin\AppData\Local\Temp\5510.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-27_f4e3c4a7eb2894036e9056d0b7435b4b_amadey_elex_smoke-loader.exe 5C499CDD76D50D6BA93F6AAD886A53DF0757E0DF9271B84D5D977E0C4D7004183553940784F1471BC52044CD02941A43B82786561820E09BE000A79228598B98
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5510.tmp

Path C:\Users\Admin\AppData\Local\Temp\5510.tmp
Size 1.9MB
SHA256 cdfcf3da3d1801aa30faa269f9526bbd353fd68ddbe311b3bad3a906d951d3ed
MD5 c181f649529f57ba293bd57f277424a2
SHA1 81e61d62f939b4d244ea5c5ad462effe28b87c4a
SHA512 21bac70a5a9a11404547c98f1af019f01563c5a738a58d67130d959381fb629c7eedb9ddc3d38472c87c61afa6dbd45fc812e4d33dafe461a18cfef8f07c6e1e
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dXxOnNK4CN/7a8oJFSBBcQeZ357baBEwVJhS8:Qoa1taC070dXxOpCt7SHT7buEmH94UHd
TLSH
T1F8952200FA91C2B2C0850A71F552C7F2D8793D7886429C837FC92B7F6960BC56A72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5544-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6288-6-0x0000000000400000-0x00000000005E6000-memory.dmp