2c2593e4ec02f6a743bd908472b7c7c5fcfc9aa40b29fd9bc998e8bb6e94ad6b

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_67f5104e25d919505ebcc5b8c59d4bb9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-a55pnsstev
SHA256 2c2593e4ec02f6a743bd908472b7c7c5fcfc9aa40b29fd9bc998e8bb6e94ad6b
MD5 67f5104e25d919505ebcc5b8c59d4bb9
SHA1 9598343de33a56227da687a3d8000ad2e1c4dc90
SHA512 01ba8ad97047b53fe68f4b25e87a4e69bd037988f20971eb3538b648eaba2938304fcb3259b731ef58a47f272a399d00d360c3ac1593e0d6b265c7fb86f72e5f
SSDEEP 49152:boa1taC070UsPFO7E2vdX+mrJKoeyS5f2TIjumptjX:boa1taC0utOlvdX+mEuTIjtptjX
TLSH
T179952261E791D2B6C4C206716652C7E2EC283EBC5605CD83BBC81B6F1D98FC12A7674B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3472	5F4D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3472	5F4D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_67f5104e25d919505ebcc5b8c59d4bb9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F4D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 3472	5888	2026-08-04_67f5104e25d919505ebcc5b8c59d4bb9_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_67f5104e25d919505ebcc5b8c59d4bb9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_67f5104e25d919505ebcc5b8c59d4bb9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Users\Admin\AppData\Local\Temp\5F4D.tmp
  "C:\Users\Admin\AppData\Local\Temp\5F4D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_67f5104e25d919505ebcc5b8c59d4bb9_amadey_elex_smoke-loader.exe B85D823EAA970714B689FD4DE8EE00B997D5C35D201531DD7C72E5471EB558A6E2B157A5EB353AD794C22D2A3A13073B0EC293097437B0CE782B9A17DCBC1ADB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F4D.tmp

Path C:\Users\Admin\AppData\Local\Temp\5F4D.tmp
Size 1.9MB
SHA256 c1a1d67c9f6f5b3c47d1d13c83cad04f5c687f4d4008a2aa583c118d6c8ec45e
MD5 cb4989a1c35e76818f115aa69689bacf
SHA1 e634d530d37efc99947b35190525fc232db9cd33
SHA512 1723e26b5a63407fe645b158609b790a0543d42d3672103528d87b4c42dda17a2c43c312d640972cba71463bf8a3d7af8e32f25bc08a1f1820a52824c5e71b7c
SSDEEP 49152:boa1taC070Ugivet90DhQnquk3V4omPh:boa1taC0Ki2c9geV4o
TLSH
T168952251F781C2B6C4910671E892C7E3D8A93EBC96458D836FC81B3F39A0ED066B2757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3472-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5888-0-0x0000000000400000-0x00000000005EB000-memory.dmp