ca21232fb201a00434593e69ce400c306f3013e4175dbcc43be301172bc8b7f7

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_0afc5665f2d958a4c59eac4a45844605_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260801-2bbchshk81
SHA256 ca21232fb201a00434593e69ce400c306f3013e4175dbcc43be301172bc8b7f7
MD5 0afc5665f2d958a4c59eac4a45844605
SHA1 4a4b564bdedc1e9d3200fbf2e16e4468aca2c4a5
SHA512 6b835712236af4235f5e208b3428946f52292e2c2061dec27f93f0e213907ef2ebf459a857bac4bc691757ab334bea8d3300b372b7ef951c7f1a527e7097a226
SSDEEP 98304:5mSWOiIyUM3eeqeFIbvKNSCVLUjH5oxFbxx:5X63e9eYK5VUjZEdx
TLSH
T1D7E52341BBC4C222D18165FA658383D7CA343F3D46269D8B2FCA2B2EAC749F57275243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1012	5EA1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_0afc5665f2d958a4c59eac4a45844605_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5EA1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1012	2932	2026-08-01_0afc5665f2d958a4c59eac4a45844605_amadey_elex_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-01_0afc5665f2d958a4c59eac4a45844605_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_0afc5665f2d958a4c59eac4a45844605_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\5EA1.tmp
  "C:\Users\Admin\AppData\Local\Temp\5EA1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_0afc5665f2d958a4c59eac4a45844605_amadey_elex_smoke-loader.exe F15771F5E042034DE57D53B64B8E562DD156B23D4F25E3BA2AA1508BC546ADE2E6F46B1249320E26672AF6219C3A34C82F1B9005A25E1BF264DCC7E2FB6DEE8F
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5EA1.tmp

Path C:\Users\Admin\AppData\Local\Temp\5EA1.tmp
Size 3.1MB
SHA256 971758ffecac2e2494ec93422cd79d67ec61245e24f8775e0c1842dd768b2adb
MD5 ea84c9037562fd9e0715aad92ce30eb5
SHA1 9d3262576921c46dae9a7534b07471c2615dc915
SHA512 ade87a489acd83e7d815af191338e6f87fb965d6209170b7d25610b94c031e1b707210c630c0365e904fa7e474c78428954831c9b4b006403139a52f993c3a83
SSDEEP 98304:5mSWOiIyUg7d+r4kYeXneSGzTVLUjH5oxFbxx:5XWOATVUjZEdx
TLSH
T12EE52340F7D4C2B2C18225F9718383DAC5743F7D5625AA8B3FC52A6EECA88F56275243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1012-6-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/2932-0-0x0000000000400000-0x000000000071F000-memory.dmp