0c51136c6097e918e79e999a154058606e1c2fe3b9c29cbadcd85e4041e935d0

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_a0f284aa8f4368fac8325cd7e2d86d15_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260707-cbe82afw71
SHA256 0c51136c6097e918e79e999a154058606e1c2fe3b9c29cbadcd85e4041e935d0
MD5 a0f284aa8f4368fac8325cd7e2d86d15
SHA1 ab2308a42d7d197ecaf8abc4775614e7118cd13b
SHA512 c1eadb2ed42bd19c9c78b013e4dd17d1963a67aa795897307dcde746ca7db4409b281e90eb2766db4d4e9b99204a54dcc10685bc6b4546b539bf3f3922e9d563
SSDEEP 24576:I2oo60HPdt+1CRiY2eOBvcj3u10U+xOyHVk1+/uuH1BC59yanxmOtQkKB+Sj/K9m:toa1taC070UuON16HK1Vmkc+S+9m
TLSH
T17B952310F7A8C2F1D49205B0A555C3E2E8A57D7D16919D876FCD6B3F2BA0EC06A72B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5672	AA21.tmp

Executes dropped EXE 1 IoCs

pid	Process
5672	AA21.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA21.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_a0f284aa8f4368fac8325cd7e2d86d15_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 5672	3000	2026-07-06_a0f284aa8f4368fac8325cd7e2d86d15_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-06_a0f284aa8f4368fac8325cd7e2d86d15_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_a0f284aa8f4368fac8325cd7e2d86d15_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\AA21.tmp
  "C:\Users\Admin\AppData\Local\Temp\AA21.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_a0f284aa8f4368fac8325cd7e2d86d15_amadey_elex_smoke-loader.exe 0FA5386619CE20A56F9EC8633C44708318B71034B3BF44E9D09B46E7A5CB0899AA2F8A4CD2F5001D5C51C25952B85FC0E898A1393DBA252FDA617BD88864FB26
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AA21.tmp

Path C:\Users\Admin\AppData\Local\Temp\AA21.tmp
Size 1.9MB
SHA256 47232565959fd30a6aa92ce2c924f17e10579b5e8d15e7c6d64c79fbd8319458
MD5 801f6d59a6cdec50451a27c15f872b2a
SHA1 6915cbc0694f7e4e75666648fc93dfdac6fe0076
SHA512 249c1ee80cde73a41bf2dfa456c6bb589f2eac2b9099e8b6ccf19e8734144bae1206bf8fa3d982af293d9f7490713684412d7a3921e9a8c8c4bb254928088329
SSDEEP 49152:toa1taC070UBzRAr5woFuYt6nO5sMwjhzom:toa1taC07zRG5wutZZwjhE
TLSH
T108952254F790C2F1C0D20A71B192C3FAD8697E7C96869D43BBC91A7F2960EC16A32753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3000-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5672-6-0x0000000000400000-0x00000000005E6000-memory.dmp