8e296ebc27682c110eb4b2738112fe155a97bbeb8ce0f2b28673ad66d1536750

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_ebbccacd897e66e8d8236050addc59fb_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260701-cnxc3set7z
SHA256 8e296ebc27682c110eb4b2738112fe155a97bbeb8ce0f2b28673ad66d1536750
MD5 ebbccacd897e66e8d8236050addc59fb
SHA1 885dbcb6ddac9ab57dca4a861967ca9bf7ba7443
SHA512 63683bf54b5e48c4bdd37d3b92887eeade6fbc356eb16ae2816269bda02c0ef4897fc27eda19a5d457a1dddd069d09de08a4af0cc9d114990513433b9145ebe9
SSDEEP 49152:Qoa1taC070dqy0WNhh9+m87ivt3yBTQ8AJ3hEMN:Qoa1taC08zhh9Si5yGEW
TLSH
T1B2952350F791C2F2C0911A71A292C7A698793E7D46918C83BFCD1BBF6960EC42B72747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6036	D731.tmp

Executes dropped EXE 1 IoCs

pid	Process
6036	D731.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_ebbccacd897e66e8d8236050addc59fb_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D731.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 6036	3840	2026-06-30_ebbccacd897e66e8d8236050addc59fb_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_ebbccacd897e66e8d8236050addc59fb_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_ebbccacd897e66e8d8236050addc59fb_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Local\Temp\D731.tmp
  "C:\Users\Admin\AppData\Local\Temp\D731.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-30_ebbccacd897e66e8d8236050addc59fb_amadey_elex_smoke-loader.exe D12EBB1CC78E863B7C89F5CC59B7CB40C07030925B111858A1C0F1E425BD24F4BF9EF33A7293E83BD74D0257DF170C9EEABC29A19F1271E4B2A9379244F8F1DC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D731.tmp

Path C:\Users\Admin\AppData\Local\Temp\D731.tmp
Size 1.9MB
SHA256 05b037fbace70a0a06654af872c274cea052b58b98064a33019c31eaa3cc8af8
MD5 490b87103ff72cb1a0bd841291f50c05
SHA1 fa8622ddbb98e01c99bff78915573c9f57ccfa5d
SHA512 353fa2cef662d1c06daf0d1c3d89c84e85539a1790a9abac8089b92a488eeb11602767d09902089e405ab8946ad299c3471f8076a2100172a69e899469e8a9cb
SSDEEP 49152:Qoa1taC070dHLvZKAsIckJatniJvNs1zWW:Qoa1taC0kvZKAs6YuvNsZWW
TLSH
T1DD952364F784C2F1C0850571A591C3A6AC7A3D7D26899D83BBCC0B7F29A0FC46976B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3840-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6036-6-0x0000000000400000-0x00000000005E6000-memory.dmp