65f33e588ab2bb30c3995d9b7d2faa428eee28edfc196e0ff9f6befc5d198177

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_97fb41e12a3474338d1685eb092f7d22_amadey_elex_smoke-loader.exe
Size 628KB
Sample261024-eaqz9aeb79
SHA256 65f33e588ab2bb30c3995d9b7d2faa428eee28edfc196e0ff9f6befc5d198177
MD5 97fb41e12a3474338d1685eb092f7d22
SHA1 1bfa9c2825e1b35fbeedf26be4b4673f93d2e429
SHA512 253d58adb4bede68747c00cebf6c18dd700de4ab2f676ce13592a47dcb1e60065165ce4a54a0c55718ccedd3df0fab235aebeb9b5a15fc4ba401060fac8ac406
SSDEEP 3072:25FfHj03yxKWP5coTvK4bWTEjthsYhMKXw627VV03c/OcnE5BP35QIN3C9ISE0qi:wH7n5W4bWA5hsGXw627V835QISzqJyZ
TLSH
T1FBD46B10B6408035F3A607315A6AEAE509796D3917A8E5CFF3783A396D702D35A3738F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5976	3392	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_97fb41e12a3474338d1685eb092f7d22_amadey_elex_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_97fb41e12a3474338d1685eb092f7d22_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_97fb41e12a3474338d1685eb092f7d22_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 256
  2⤵
  - Program crash
  PID:5976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3392 -ip 3392
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3392-0-0x0000000000A20000-0x0000000000AC2000-memory.dmp

Download