3c7dbb034ddbbc113b655f5fcd2b1ef81ad72c9072aa8ee27de366a835cbf8cf

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_32eb20a6e18b548e2c6b0bc4c04f56fc_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260630-narffsdw9l
SHA256 3c7dbb034ddbbc113b655f5fcd2b1ef81ad72c9072aa8ee27de366a835cbf8cf
MD5 32eb20a6e18b548e2c6b0bc4c04f56fc
SHA1 73073337ece208d57cb13d4e68c49d5bd2ec5978
SHA512 27dfe83767d7a4094d8ab09926b1fcbc2d926d3fb9737f78657ead43f336d5f425ec4e8e8e856595b1afa12aaa70b642ae4b06c9bfaf8bebcb6ade1a0a458769
SSDEEP 49152:+vm2AC0d1XqrdryeJVobXg9HoOhxBDQoL1K4wLVT5kUvgJSgHT6ojkxFbxLWC3:Cmhd1UryeWnOhfQzTVLUjH5oxFbx
TLSH
T125262381B7D5C271C08029F9699383DBDA343F7D4A359E4B2FC92B2E9CA49E17235613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3032	8EFC.tmp

Executes dropped EXE 1 IoCs

pid	Process
3032	8EFC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_32eb20a6e18b548e2c6b0bc4c04f56fc_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8EFC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6952 wrote to memory of 3032	6952	2026-06-29_32eb20a6e18b548e2c6b0bc4c04f56fc_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-29_32eb20a6e18b548e2c6b0bc4c04f56fc_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_32eb20a6e18b548e2c6b0bc4c04f56fc_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6952
- C:\Users\Admin\AppData\Local\Temp\8EFC.tmp
  "C:\Users\Admin\AppData\Local\Temp\8EFC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-29_32eb20a6e18b548e2c6b0bc4c04f56fc_amadey_elex_smoke-loader.exe EA85BEF3FC6F9F8E82E1745A8A724F85C1518C8D5D89FB6E0205D49C7B6577E645E825B46C1B27FE1D2C0B8E8E38B769B7C576FD1E8EBB5E4A51074EF1877932
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8EFC.tmp

Path C:\Users\Admin\AppData\Local\Temp\8EFC.tmp
Size 4.2MB
SHA256 9b86fc8a9375950535a22f7b6b27d7791e996d0a75bcc49efcf5d28f30f86ca9
MD5 23dc8dc28f020679295948ebf3d3588b
SHA1 ca798f243843641b460d5852bfcb968cbe07533e
SHA512 34a1729cdc30b4c04b3b8531a53532d0de0ea8e22202a22be63c092f2d15ff37defffea1633a5a2125a24a7589d4bb906be59bf0902c1287aea660b1657919fb
SSDEEP 98304:Cmhd1UryezFw89iemu2mU2btiVLUjH5oxFbx:ClTmneMmOVUjZEd
TLSH
T1E8262300BB95C1B6C08166F9648383DBD9343E3C96255D8B3FCD1B2E9C689F2637A653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3032-6-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6952-0-0x0000000000400000-0x0000000000849000-memory.dmp