c61b642576764a9311202dc34c4f0f60c9e3c728dc33cbdff439a0a663a902c4

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_bf54b47c1a27e72ab8f72f4e1969e8ec_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-p546gazthy
SHA256 c61b642576764a9311202dc34c4f0f60c9e3c728dc33cbdff439a0a663a902c4
MD5 bf54b47c1a27e72ab8f72f4e1969e8ec
SHA1 59499a35f7b58546305d600cb7309237161a734d
SHA512 32b841dc88feedc56ed701799fc09b86dd2fc6cc74d8a6347a8644c7b411da573297dc15d5823557cdcef601a0a32598e2057673443c48fdb73afe468b541525
SSDEEP 49152:Qoa1taC070dKdHqhmo6fNWGxBVWwogFMk2RR0AhWoL9d3wmLZB:Qoa1taC0z1qhS/w08
TLSH
T186952220FB94C1B6C0810A35A652C3A7D9B43EBC57458DC3BFC82A6F2D60EC45A7975B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5012	DC61.tmp

Executes dropped EXE 1 IoCs

pid	Process
5012	DC61.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_bf54b47c1a27e72ab8f72f4e1969e8ec_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DC61.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 5012	2552	2026-08-01_bf54b47c1a27e72ab8f72f4e1969e8ec_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_bf54b47c1a27e72ab8f72f4e1969e8ec_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_bf54b47c1a27e72ab8f72f4e1969e8ec_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\DC61.tmp
  "C:\Users\Admin\AppData\Local\Temp\DC61.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_bf54b47c1a27e72ab8f72f4e1969e8ec_amadey_elex_smoke-loader.exe 888F6568F1522F5EC9B8E4153D268FF488D6A163553BECDA59AC52175EC2D157B4EF5CA9924F9A42ECA3A02457A6D62A015D06FA2DF58C3FDCFDF002845499B5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DC61.tmp

Path C:\Users\Admin\AppData\Local\Temp\DC61.tmp
Size 1.9MB
SHA256 56d8150972d7c74d84c06541254295e515a6f93dac4901febe477ca18a4c5e0c
MD5 7daad908f85d9a63acc4c3ba0e599031
SHA1 fbd85db2f449e4765a25197c28838c958d913448
SHA512 371eea62d8562229f1a15139b75d5b165f788d8662b82b79145dfc096db3c6df60ba5bfa865fda471422584eab2add6e4fa78f73f68023ce9b145b8dcae6df8a
SSDEEP 49152:Qoa1taC070dQ9l3zOrz9w3l1qFYvbL4yYe+B:Qoa1taC0hl8iqFEd
TLSH
T125952364F780D2B1D0850635A961C3E6ECA43EBC57528DC77BC81B6F2D60EC06A3976B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2552-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5012-6-0x0000000000400000-0x00000000005E6000-memory.dmp