bebc6bf3949a6d746a2e9d8bfe693f2914957638e1609bb488e372f82a966f0b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_a7ea83fde9c9d0b8cfe916fe0f88d40a_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260803-kxztkavvbz
SHA256 bebc6bf3949a6d746a2e9d8bfe693f2914957638e1609bb488e372f82a966f0b
MD5 a7ea83fde9c9d0b8cfe916fe0f88d40a
SHA1 5a3a0d000ddfab76ddc96667748ecf6ceb6079e2
SHA512 762421133cc49c590de3bb867a4436b26644d5bba676440e84fd3cbb98a59bfaece89e247be5ee9791e7e0cece1caaf0d8576ee48e945971cfb292be1f168368
SSDEEP 49152:foa1tqC070Xk2UwdcWjIDCM4gp/DKly7ZTEocWM42A2k0jEalz:foa1tqC0f2UwdljqCM9/DgyJEocWv/Qj
TLSH
T11FA50201B3E68170F0F25A34A9B282516D763D7817F19ACB2EB4DA5F1E71AC09D71B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5804	51C0.tmp

Executes dropped EXE 1 IoCs

pid	Process
5804	51C0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_a7ea83fde9c9d0b8cfe916fe0f88d40a_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51C0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 5804	5292	2026-08-03_a7ea83fde9c9d0b8cfe916fe0f88d40a_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_a7ea83fde9c9d0b8cfe916fe0f88d40a_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a7ea83fde9c9d0b8cfe916fe0f88d40a_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Users\Admin\AppData\Local\Temp\51C0.tmp
  "C:\Users\Admin\AppData\Local\Temp\51C0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_a7ea83fde9c9d0b8cfe916fe0f88d40a_amadey_elex_smoke-loader.exe 29FC4F4F094D5B2AF80B6DDCB2D597D104DA400CCAC532F1F7B219871B0BFB79D10B34C0280722B12D408061ACBCE0D34C49FC3237C07C1CCD5A130FB00213FF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

51C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\51C0.tmp
Size 2.0MB
SHA256 e24fd7d12b12df0d4075b3515e29d9cef941a2d1a3c83a93c2c0f31bf049f76f
MD5 a34b4ad2a48a198a28383d6efa908b90
SHA1 41aa925720c69d4f12c66fd8bf0950d9b1112b58
SHA512 5dfaff670b12b32c17b17153f28ba831569e32a91636c9f2b1a5b97cfa367119ada2d5bb7f7d2eca688a551f4db1ff650476f8ba0598bd0336229e9a1a0dd104
SSDEEP 49152:foa1tqC070XTOduF6rQ6JilHVLrWv6FFlz:foa1tqC0iO8FeQw
TLSH
T1E4A50201B3E641B1F4B70A3099B28251ADB63D785BF1998F2EB8D61F1E71AC05D72723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5292-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5804-6-0x0000000000400000-0x00000000005E6000-memory.dmp