61a79ba0b853b5953d6ba3364e2bdf6feb1b65e86b6e45b7dc1ce6a9a61ba193

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_7f3c76ea735df05bac014bd20de4ed03_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260629-gdxy3sd16w
SHA256 61a79ba0b853b5953d6ba3364e2bdf6feb1b65e86b6e45b7dc1ce6a9a61ba193
MD5 7f3c76ea735df05bac014bd20de4ed03
SHA1 670268918329e807ed4661d3b0d9353f06cdef63
SHA512 f7cf1a1af06dcbdc33058ea76f9c058504b68565ff6c080f74018a58c06db2b474cdc5d9fa04c1ce7400df0e40d6064e3ab9db701230fe226471527dc51ca6bd
SSDEEP 98304:emhd1UryeHDWC2r27fVrbM+asAyX0wV7wQqZUha5jtSyZIUS:elnCxgfVXzX0w2QbaZtlir
TLSH
T1D056BF05DBE8EF1EC91F03B590B2222657FAD494E783AFD6A951F5B07E82310BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5176	49F0.tmp

Executes dropped EXE 1 IoCs

pid	Process
5176	49F0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_7f3c76ea735df05bac014bd20de4ed03_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49F0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 5176	712	2026-06-27_7f3c76ea735df05bac014bd20de4ed03_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-27_7f3c76ea735df05bac014bd20de4ed03_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_7f3c76ea735df05bac014bd20de4ed03_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:712
- C:\Users\Admin\AppData\Local\Temp\49F0.tmp
  "C:\Users\Admin\AppData\Local\Temp\49F0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-27_7f3c76ea735df05bac014bd20de4ed03_amadey_elex_smoke-loader.exe 6B068B2686A56A10F98E06094F88815BC1FD74F5F1E496EA18C8D24EC0EF035EFC709013C5115C66EE29EDD6F35FA53C408D459EFA8FDAEF05BA188018CD2F2A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

49F0.tmp

Path C:\Users\Admin\AppData\Local\Temp\49F0.tmp
Size 6.0MB
SHA256 50f999a73d4e32a2f8c9ab4bafde3229fbaa4d32d588572c927de30644730eb3
MD5 ad5bd687911e338a37eda5ddbdc2825c
SHA1 5074ae0d52c2534f93378fa4a309dbd13ca6b629
SHA512 17af6c81b30331623359ba5152d5e4f00354d277b02d63ffb917da8c15b9b5eb5e14cd92f421a25fa55a3826590d50c726119e6feacae38e405bb07a2132dc27
SSDEEP 98304:emhd1UryeSDze6VIybzXdFyVAV7wQqZUha5jtSyZIUS:elyDfNFX2QbaZtlir
TLSH
T16C56BF05DBE8EF1EC51F03B590B2222657FAD894E783AFD6A951F5B07E82350BE02153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5176-6-0x0000000000400000-0x0000000000849000-memory.dmp