6a30a5cffe7abb6a2093d9f12ddddfdea54055ec2158b5d9e3b592bb8d978843

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-2fcfdayxev
SHA256 6a30a5cffe7abb6a2093d9f12ddddfdea54055ec2158b5d9e3b592bb8d978843
MD5 02f00064c94bb9e9f2d90b76f52b0e7f
SHA1 6fb0d782aa26f5a5fc2680a6a545a668d2eef167
SHA512 50ed7251085f441494406df38404d6630a563091cb2e7fa3ca905a718f902b75b5decfa972d9aedefcec243a898c28a0ed444f163bcae203a36a365abb91c81f
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d4AQtYNrHDIdYxyCrornfVVTx2pYxdYKtvUE:Qoa1taC070dtQtCrU2xyCcTdVEjKtF
TLSH
T109952254F3C5C2B2C0C20A75E69283F69C793E7896459C437BC91B2F2EA4FC46A36617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3152	6B14.tmp

Executes dropped EXE 1 IoCs

pid	Process
3152	6B14.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6B14.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 3152	5996	2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Users\Admin\AppData\Local\Temp\6B14.tmp
  "C:\Users\Admin\AppData\Local\Temp\6B14.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe FF5A77A759DD1DD20033610B423832F39DDAD3C78A0F7217CF3FF548568616C22A81F70169E0B16C8812EE3DF8F4016DA6A98E91C8E7C73DCA8C70BD9BA4F4D5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6B14.tmp

Path C:\Users\Admin\AppData\Local\Temp\6B14.tmp
Size 1.9MB
SHA256 8e83e17ef4572a34346168aca078825f4a90cc4068f8059bbd85b08887672737
MD5 afb3a1e7aa9a4d37679d77472e9b008c
SHA1 0cb862f110ad5fd8caeb417d3dd9a8417332789b
SHA512 d495ffc285b99b3c99f6a3bd13e55f2c1352be90fd2cf05151297688f46714762c85691274446d9933841ffec7488674d28324212c2c3602c32eb4803a6cb8b9
SSDEEP 49152:Qoa1taC070d9iWleebvRJRJ6eb3szazwzOM:Qoa1taC0wReUjRJ6e7GCLM
TLSH
T154952210F7E0D2F6C0810AB2B5A2C6B798692D799B419C477BCD2B3F2D94EC09A71717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3152-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5996-0-0x0000000000400000-0x00000000005E6000-memory.dmp