bf4878bf2f0fd8196e415b64569a4b1ddc46b9a105610bc3cecb6fe9ea80cc62

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_a652d6e96e5973a44b7a66f9c7774b74_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260701-d1qlqsft8w
SHA256 bf4878bf2f0fd8196e415b64569a4b1ddc46b9a105610bc3cecb6fe9ea80cc62
MD5 a652d6e96e5973a44b7a66f9c7774b74
SHA1 b061522bd2cebee21ac13a1574b72ff44f9e8cac
SHA512 a31414aeb4db2669dd0c9320390ff7edf90f15e4c2574f261d8f1755acc0e4e7ca6e522bdb255f4ae8f43cdf68f304bc088436aba86b4beb70834d24dcbbba57
SSDEEP 49152:Fvm22OdWOXqrbIyUJGLeXlUO6GOL4yEaGfk8CGmFpwLVT5kUvgJSgHT6ojkxFbxx:5mSWOiIyUvwj0fLCGmFyVLUjH5oxFbxx
TLSH
T1C5E52340BB95C272D09235F9619387EBD9343F7C562298877FCD2B2EDC748E1A674282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5748	5460.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_a652d6e96e5973a44b7a66f9c7774b74_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5460.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 5748	1320	2026-06-30_a652d6e96e5973a44b7a66f9c7774b74_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_a652d6e96e5973a44b7a66f9c7774b74_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_a652d6e96e5973a44b7a66f9c7774b74_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\5460.tmp
  "C:\Users\Admin\AppData\Local\Temp\5460.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-30_a652d6e96e5973a44b7a66f9c7774b74_amadey_elex_smoke-loader.exe 9CE072E45C1D5A7CC2E580E790EF29F28F1276923DFBBEEF4A0870302FA67F15CEE53B3A2779E0F60C1B24EC503F13349E03136AF574705BBC20B14C6FE636BE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5460.tmp

Path C:\Users\Admin\AppData\Local\Temp\5460.tmp
Size 3.1MB
SHA256 499e2200294a99e91c4c9409f7d140645b5532cf69664646ab8497b98556530c
MD5 e3ea8b05f3269690ab601f7135c4bd8e
SHA1 2754a823fdc97c73618004600b4e7c40048b9f6c
SHA512 5bca187f5f16eea39936a5f936a5237b537415cd14992cc779b1dfdace578442c3b7aa68eeb0a3932b2e9adcfb18fea0a83c617ba6df8c8b592982a72b9f93a1
SSDEEP 98304:5mSWOiIyUjBHfNHV2fknXVLUjH5oxFbxx:5XNxfNbXVUjZEdx
TLSH
T1EFE52351BB91C262D04121FA688383C696343F3D5625BA8B3FCE2A1E9CA99F17775343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1320-0-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/5748-6-0x0000000000400000-0x000000000071F000-memory.dmp