f87f06c97967d84f89b2367f578941effce1ce3eb59a76cf9a1235ea83f07bca

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_a594565d7548226bac8a4706e4a9fa6c_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261029-1phhbace76
SHA256 f87f06c97967d84f89b2367f578941effce1ce3eb59a76cf9a1235ea83f07bca
MD5 a594565d7548226bac8a4706e4a9fa6c
SHA1 f7a29bb9e3679a37cc14197a85de8c0704db9d1f
SHA512 284cd9ccd356574558ea47f355a7f5b8eddd4025ce5be8b670314dab1e638aca0297f5f5815f86c7b68df3eea04665b85140380efb50bd5891495820ebadb157
SSDEEP 49152:eoa1taC070UNwqS27BTQ4e0hxo5VDPpu:eoa1taC0jwqSk5QsboPDpu
TLSH
T1C3952261F7D2C2B2C0810630A592C3E2D86A3EBD46455D837BD86B7F5994FC06732B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5140	5857.tmp

Executes dropped EXE 1 IoCs

pid	Process
5140	5857.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_a594565d7548226bac8a4706e4a9fa6c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5857.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 5140	5636	2026-10-28_a594565d7548226bac8a4706e4a9fa6c_amadey_elex_smoke-loader.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-28_a594565d7548226bac8a4706e4a9fa6c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_a594565d7548226bac8a4706e4a9fa6c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Users\Admin\AppData\Local\Temp\5857.tmp
  "C:\Users\Admin\AppData\Local\Temp\5857.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-28_a594565d7548226bac8a4706e4a9fa6c_amadey_elex_smoke-loader.exe EED467C98A487FCD07514A20AAC4DC6F5C93894C00E3A05FC2E0F7492DFA67565AF42256E92CE73BB0D59C3C905640070370BC1FF385A792244243B51175882D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5857.tmp

Path C:\Users\Admin\AppData\Local\Temp\5857.tmp
Size 1.9MB
SHA256 f9de64d7f3f298bb68cd77cf6b231a21a663d4557b93e8ebb4020442af39f80f
MD5 8c5bc343552be24a005c4273eb327e86
SHA1 64c0595d8127399e563a290eb37ebdbc9f691084
SHA512 6df058d489d15ff73fc78aae8d6c4c1c2289f498922002aacb9b0e6f7883de0f15b09114e3bc961e3869d1ea4d43d9b1f507f14d60dde10f112c2c0761f98629
SSDEEP 49152:eoa1taC070Uv8BWOPiPNoAt/FQ+aEbTn8HZ5Ng7C:eoa1taC0p8BWOPmdttQby83C7
TLSH
T1A2952350F784C2B2D0861A71A152C7E69CA93EB997458D437FCD1B3F2E60EC06A36787
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5140-6-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/5636-0-0x0000000000400000-0x00000000005EB000-memory.dmp