ec5ca4ee9b62401478da69889580e982be8a2f0b4659a7b0a38e8bd4fe804c04

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_0abdd8e4e549d2b5db263b1355af0dd1_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260728-gpp3lsck2v
SHA256 ec5ca4ee9b62401478da69889580e982be8a2f0b4659a7b0a38e8bd4fe804c04
MD5 0abdd8e4e549d2b5db263b1355af0dd1
SHA1 7675b045d44ef968b5daa663c3c58fe5e5c6cd69
SHA512 742778b441542be65bfcf5f1cc8d0a39479c1ac45681ea67fd15470dfac444055e5a995e2e10febae686f205868efe13682c81e8f4db9e9f769e3bd25e143b23
SSDEEP 49152:eoa1taC070dFLKAfLXkO8iU7gZ94TMRLafXQFLT:eoa1taC0w/DkyUk4T4L6Xq
TLSH
T127952251FBD4C2B2C4910A71A66187B2DC627E7C87419D836BC81F7F2DA0BC4AA76707
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2960	648C.tmp

Executes dropped EXE 1 IoCs

pid	Process
2960	648C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_0abdd8e4e549d2b5db263b1355af0dd1_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	648C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2960	2496	2026-07-28_0abdd8e4e549d2b5db263b1355af0dd1_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_0abdd8e4e549d2b5db263b1355af0dd1_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_0abdd8e4e549d2b5db263b1355af0dd1_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\648C.tmp
  "C:\Users\Admin\AppData\Local\Temp\648C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_0abdd8e4e549d2b5db263b1355af0dd1_amadey_elex_smoke-loader.exe 51868CA0FC38202145BCAC53970558FC82DF4932D7E2D62E6A683FDDFF06B39A7E1A6D981989B38528427FD7BBF308F97602F55965974DF310B76643DC0747A1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

648C.tmp

Path C:\Users\Admin\AppData\Local\Temp\648C.tmp
Size 1.9MB
SHA256 fce09fefe6603187731cfda79f18a6abedece713c754f544e3d96415f350deee
MD5 b41dc20dbd4a03506e69b417c0f56fab
SHA1 871e5401ff7f65512a47d8c0c725b41213863637
SHA512 7a5cbdd646738da2ff720468825ba5f8167758c8c334707db4dd42151c4b6962dc9f05beb1ddc4f438d073421aecbefe92c5d9c4b8cecb8306cc287f021dede1
SSDEEP 49152:eoa1taC070dblclPNBsrP7OyJvFDFtbcQ+KsEa:eoa1taC0EMVurP5vxtts/
TLSH
T160952210F795D2F3D0810570B291C3A6D8A93EBC6A419D837FC91B3F6EA0AC46A71B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2496-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2960-6-0x0000000000400000-0x00000000005E6000-memory.dmp