b29b002624e83bbddbb5da77a38230bdb5d49ece86b28e8d45c5b118a9756ac9

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_9ac6bf26148a1ea6e0fc67ac7e60cbf5_amadey_elex_smoke-loader_stop.exe
Size 3.2MB
Sample261017-navg4ssvas
SHA256 b29b002624e83bbddbb5da77a38230bdb5d49ece86b28e8d45c5b118a9756ac9
MD5 9ac6bf26148a1ea6e0fc67ac7e60cbf5
SHA1 85858a330704176bbc409463d298ac385adb47fc
SHA512 774b7dc6b013748c6cd12a7fb3ef148bd2de02fbd8ca33c205b906aa0211f14599d7af8ad0dbbcfbf7625abaf35ac662e79c1836a1e6ff4f2eb066a32919eebe
SSDEEP 98304:L+c4t84tQSkY3LcKoYUSLpEPnd8c0tueeUa6GQs2zKM0b14FaIjx:L+/84JkMILYUPfd8cAveUa6GQRW91OP
TLSH
T1CDF52220F6C49076E5A213B0391A81269BEDFDB05B76C4C7F7661BC9A9F16C1E23D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_9ac6bf26148a1ea6e0fc67ac7e60cbf5_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_9ac6bf26148a1ea6e0fc67ac7e60cbf5_amadey_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 4832	5700	2026-10-16_9ac6bf26148a1ea6e0fc67ac7e60cbf5_amadey_elex_smoke-loader_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-16_9ac6bf26148a1ea6e0fc67ac7e60cbf5_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_9ac6bf26148a1ea6e0fc67ac7e60cbf5_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Users\Admin\AppData\Local\Temp\2026-10-16_9ac6bf26148a1ea6e0fc67ac7e60cbf5_amadey_elex_smoke-loader_stop.exe
  -deleter
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ISPackFiles.ini

Path C:\Users\Admin\AppData\Local\Temp\ISPackFiles.ini
Size 545B
SHA256 d6ffa792007529ac64033c365ba9a6f980a0d109adeb32c033ddb9dad89c4b8a
MD5 d0a2abc7ec0b3a7422c7c441291f4a34
SHA1 4ce422ae2cc335e8f7aed61e433cfef0cd6aaea3
SHA512 8fec1ab22637c5625ac5b3f0868284421b8b247163d72947f765500cb29712627f87239ea9b022813ca246978dd048d438c6e204b789c5d8584153e976b1dd58
TLSH
T1CAF017569ADFDB9D3404A0A715F9967FE0B02E48BF49B7318678D50C558AC0FF9C1382
MD5 SHA1 SHA512 TLSH

Submit Download