2b3a296c6af2e67a1ab643acd8a5572f11f13081faaf21a1f181ebd266a50877

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_8e84ac99f8a55a008b7827a232b6f778_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260701-efkqesfx8v
SHA256 2b3a296c6af2e67a1ab643acd8a5572f11f13081faaf21a1f181ebd266a50877
MD5 8e84ac99f8a55a008b7827a232b6f778
SHA1 0e8105d629f6318c9a01e97e55377f54746657cc
SHA512 26af076965a3ec2f15014c63ba3995025ccf17f7e6dde2aa9a1fc571309e2828ecaffae86421cecef52d1585932625df57b87aba45274433cb136acc355cfb35
SSDEEP 24576:v2oo60HPdt+1CRiY2eOBvcj3u10UIXfWTrzGbFwkG3clAI4GhY07Iq8lZ4J3WHJW:+oa1taC070UdTrtU4wjsZqGHJPMfj3T
TLSH
T12266BC00556AF3618A802930997EB259D4E0ACA487FD48F37E8C3AF9D773BE33572645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6020	B5BE.tmp

Executes dropped EXE 1 IoCs

pid	Process
6020	B5BE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_8e84ac99f8a55a008b7827a232b6f778_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B5BE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 6020	6080	2026-06-30_8e84ac99f8a55a008b7827a232b6f778_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-30_8e84ac99f8a55a008b7827a232b6f778_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_8e84ac99f8a55a008b7827a232b6f778_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Users\Admin\AppData\Local\Temp\B5BE.tmp
  "C:\Users\Admin\AppData\Local\Temp\B5BE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-30_8e84ac99f8a55a008b7827a232b6f778_amadey_elex_smoke-loader.exe 9FF46E03559C8DC40B8E27BB319DC707393CCA648781A7A98C0154AAED5D8EC5E49049FF265F155F03537742DCE78B80060D05E7CAC526301976F6E4CFD6C15C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B5BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\B5BE.tmp
Size 6.5MB
SHA256 76ac020f42009d51c0175541f47ae6a8130c6620db7ad207a1014d93e3d5531a
MD5 099f36daa46d22bd576bc541fbbc65ba
SHA1 e6e23d9a54bc26aea9536bcab9234e8b1427bbde
SHA512 885e323fee107798f2f1a784ce4274cf2e92412dd66fe49b77db0d4833a9f462fd50b58875dcc72857408db0e19ac116e3e4769f1184e8938b7386a8dbff079f
SSDEEP 49152:+oa1taC070UUuVCFZvxtErwCjkXw8PLQakOoSPR0B8YtC:+oa1taC0KuYXvmwHXw8EakOoY03Y
TLSH
T10566BC10516AF3618A812930987EB159C4E4ADA893FD58F33D8C3AF9D773BE37532606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6020-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/6080-0-0x0000000000400000-0x00000000005EB000-memory.dmp