64fadbcbd4cd8a50f3da66d39934cbbba15a5f62193296488e8208c6368fca21

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_e52ea81c8a15b7d938c4d6c5957db297_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260704-vjvb2aas8w
SHA256 64fadbcbd4cd8a50f3da66d39934cbbba15a5f62193296488e8208c6368fca21
MD5 e52ea81c8a15b7d938c4d6c5957db297
SHA1 0252b9b879f5bbe12b25157d22e174b371787377
SHA512 99994168a64cccea04942b1aea7acd43c629dde868f120a6667f8e6702a40a483808238c38b874dafe6fc8a00b3193386d23d45643f7ab6dbe550aa9137e21a9
SSDEEP 49152:boa1taC070U01rfFOEOindT2vxq+o0hZ2/:boa1taC0erdO7ih2vZr2/
TLSH
T15D952250FB95C2B6C4860635A1A2C3E3D8363E7D57419D83BBC91A7F2D64EC06B32A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3216	5133.tmp

Executes dropped EXE 1 IoCs

pid	Process
3216	5133.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_e52ea81c8a15b7d938c4d6c5957db297_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5133.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3216	4876	2026-07-04_e52ea81c8a15b7d938c4d6c5957db297_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_e52ea81c8a15b7d938c4d6c5957db297_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_e52ea81c8a15b7d938c4d6c5957db297_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\5133.tmp
  "C:\Users\Admin\AppData\Local\Temp\5133.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-04_e52ea81c8a15b7d938c4d6c5957db297_amadey_elex_smoke-loader.exe 674A3306FFCC1D7FF06C8F0A03A0B33971985BDE87B70CAB090FA82FCD35FE70E0952E05DC1AA26062B0DBCB5980F5521F0565B0BE16A3994874B8005E2CB63B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5133.tmp

Path C:\Users\Admin\AppData\Local\Temp\5133.tmp
Size 1.9MB
SHA256 8c1e22f03cae11464856ca990c49ec495a0faf8ad574f1057a7b8dcdf39db549
MD5 da3153e7803a90b080eb7fb7f3e8d3fd
SHA1 e31062f433619c42f9018783662f49404bf4aecf
SHA512 ebcb7dd1dc2c221115977b0dff7c7fdd14fba23853dd6737b05c82423a297ead47f56da5e824cdfb6b6984c639ffffea68fa383f9a45abf0ef20673ff7364dc0
SSDEEP 24576:S2oo60HPdt+1CRiY2eOBvcj3u10URdqhYG3pn670613MT/WY4YDs16mOeFup:boa1taC070UPIvAvY/WYNDM6fUu
TLSH
T172951255F795C2F2D4814970B6A2C3E79CA93D7C96428C837BC81A2F5990FC0AB71B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4876-0-0x0000000000400000-0x00000000005EB000-memory.dmp