f8b5cc725e124abfc3b2bc1dffa613dcf3d086ddeb84a8675b6eccf01207ad0b

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_d3114ea5fbb35de9dde0ae5ac731269c_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260629-c2575sbt9z
SHA256 f8b5cc725e124abfc3b2bc1dffa613dcf3d086ddeb84a8675b6eccf01207ad0b
MD5 d3114ea5fbb35de9dde0ae5ac731269c
SHA1 5ed6349a9fa3aae565594729a6a64ccee470d3b9
SHA512 ee2b9c92f7ba71fd999d778bd2871cb4a174d9b981fe4e95db7ce7b18f46c546587f43115b2983f43e39f15b775c62bad2011aa237e35c79275d6cde238d1e83
SSDEEP 49152:foa1taC070dtjwjeSneyhGZLGfSkYwntG7v8:foa1taC0mjwjeSJhCLGptE70
TLSH
T145952351F784C2B2C0811A71AAA187E7DC693E3C52554D83BFD81B7F2CA4EC0AA75B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6428	A832.tmp

Executes dropped EXE 1 IoCs

pid	Process
6428	A832.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_d3114ea5fbb35de9dde0ae5ac731269c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A832.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6984 wrote to memory of 6428	6984	2026-06-27_d3114ea5fbb35de9dde0ae5ac731269c_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_d3114ea5fbb35de9dde0ae5ac731269c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_d3114ea5fbb35de9dde0ae5ac731269c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6984
- C:\Users\Admin\AppData\Local\Temp\A832.tmp
  "C:\Users\Admin\AppData\Local\Temp\A832.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-27_d3114ea5fbb35de9dde0ae5ac731269c_amadey_elex_smoke-loader.exe 9C259051ED8E4C3864BD5EEA1D276EAF430E3F042B3FB7325CCC4473E56BC5BC2A2BE42C14537CBADCC92F20E56117577695324FA247BAE477FA2EFBE1BB1F2D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A832.tmp

Path C:\Users\Admin\AppData\Local\Temp\A832.tmp
Size 1.9MB
SHA256 63895851a795cb2b7e8640ddd1115b893aee18a5f8be4846380aaac636b54678
MD5 d22e3cc7bdce4b01735afc984090009a
SHA1 bd690fe8bcdde65e877164489fb542b596b8b8b1
SHA512 39ad65c2626763ce83f83daabbba7449ae8e9f39fc913d901e1d44c9d01056bac190c1be2aa66022dbc37a4f634669acb0a8e6f1fbb09930ffc938772c095575
SSDEEP 49152:foa1taC070dVtn+Sr8YVU1AFBDarpL0h2MHxCAF:foa1taC0YnoYC1Olgkj
TLSH
T1E3952314F781C2F0D4910A72A1A0C3D298A93E7D96468D87BFDD1B3E69A0FC05E76B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6428-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6984-0-0x0000000000400000-0x00000000005E6000-memory.dmp