cbe0192953596f5dcbc9d8f4099e9f1d8e543eeb4258a74332966c5a3cb5c5a3

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_52339f507723563e1cf472a860efe169_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260630-ln48csct2l
SHA256 cbe0192953596f5dcbc9d8f4099e9f1d8e543eeb4258a74332966c5a3cb5c5a3
MD5 52339f507723563e1cf472a860efe169
SHA1 7e4f2ce7896375d780e3455d8482574be5a673b9
SHA512 858b72ef4851ede163231c4a4e74356cc6be692a5ccba85154fa3ee43987d7d52cc303274ee0a761269a8d26d8d909336dcc43c3da950096ba6a88cd9b623283
SSDEEP 49152:Qoa1taC070dEwPQkhaUil8Y/0SiIDVn2Oy:Qoa1taC0Vahwj6IDY
TLSH
T1EA952210F685C2B2C0960A71E652C7E2D8B57E7D97428C877FDC0B6F29A0FC0666578B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5896	819F.tmp

Executes dropped EXE 1 IoCs

pid	Process
5896	819F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_52339f507723563e1cf472a860efe169_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	819F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6008 wrote to memory of 5896	6008	2026-06-29_52339f507723563e1cf472a860efe169_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-29_52339f507723563e1cf472a860efe169_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_52339f507723563e1cf472a860efe169_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Users\Admin\AppData\Local\Temp\819F.tmp
  "C:\Users\Admin\AppData\Local\Temp\819F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-29_52339f507723563e1cf472a860efe169_amadey_elex_smoke-loader.exe 2E9D1A873492FFE3125C32806B0963D5B4092A41093AC534846E6E61D86AC094CD1AEC8252F7AE4E413454B33A712708CF7FBEFFC6D4CC81BB5A760C06739306
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

819F.tmp

Path C:\Users\Admin\AppData\Local\Temp\819F.tmp
Size 1.9MB
SHA256 119a9e53b12cb9eaa4fa85cf192fcd4251d8ca9c8d7fd162503d1e03549c29ea
MD5 3810c77510f3232ca329487ff64f45c3
SHA1 86892fcb79d279caf68feb68eeae2f1e44b0d18f
SHA512 c669953e912a71f020ad6cfc0ad7b6a215a9f29417c0d60a383e545dcdd23af3df893ed14f4a6cd026ac3f603e0ab83846d6b42a5a19e7c5a206e94108afaa62
SSDEEP 49152:Qoa1taC070dDtz4/04/B0tXyFqxlD+Tp4d:Qoa1taC0ots/B01lD+Tpi
TLSH
T14A952266F7C1C2B2C08106B4A591C7F6D8767D7D56418C837BCC2B3F29A1AC09AB5B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5896-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6008-0-0x0000000000400000-0x00000000005E6000-memory.dmp