157bae7ac01a84d1a7d7e5bc48c27907527e34f976d32939fe68a41f7b1c27a8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_95d64df3a735e9e5e863c16ef21f28f0_amadey_elex_smoke-loader_stop.exe
Size 3.6MB
Sample261020-pgnhtay1ft
SHA256 157bae7ac01a84d1a7d7e5bc48c27907527e34f976d32939fe68a41f7b1c27a8
MD5 95d64df3a735e9e5e863c16ef21f28f0
SHA1 097c8f70e24743feb84ed19643a12ab040b2332b
SHA512 bc63bcd10884d674e1d0ef340f233a8bde1b4e43149baaff9d1ae70ebe99d5d7ce3fc2c55a06e8476f15548530d92cc0e9e3c6af33238943463e0b204d73b08d
SSDEEP 98304:Ltr4t84tQSkY3LcKoYUSLpEPnd8cc2zKM0w14FaIj/:LtG84JkMILYUPfd8chWu1Ox
TLSH
T108060131F0D41331DAA103B2771295A7FB3FDBE9A22AD566BA6A426021C27DCC33D355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-19_95d64df3a735e9e5e863c16ef21f28f0_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-19_95d64df3a735e9e5e863c16ef21f28f0_amadey_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4440	2204	2026-10-19_95d64df3a735e9e5e863c16ef21f28f0_amadey_elex_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-19_95d64df3a735e9e5e863c16ef21f28f0_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_95d64df3a735e9e5e863c16ef21f28f0_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\2026-10-19_95d64df3a735e9e5e863c16ef21f28f0_amadey_elex_smoke-loader_stop.exe
  -deleter
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ISPackFiles.ini

Path C:\Users\Admin\AppData\Local\Temp\ISPackFiles.ini
Size 545B
SHA256 6263ec337a1d8f3d9227c169281e827fd4aedf791cce4bfad979a3485cdd6f13
MD5 68b7fd4822f296e98cfdf24d908e904c
SHA1 4b10b4723a7ce20e2615979ce5b3a94df00008b9
SHA512 3fe57468c72b2cdc08b62dd0b3c5df500522616a6aab18d92dc6f37789eb203affd8661ac258ee33aaf429c065d686db3f06c2747d99fcdbebae2e3326c30c9c
TLSH
T1C9F044569A8ADB9D3406E0A715F9927EE1B02D0C2F4977318632948C268AC0EFAC1382
MD5 SHA1 SHA512 TLSH

Submit Download