a4b2d93997c601d437720bf18148044e12fccfd1a104d2c53602ed54b214bc3a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 21:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_6645afbc20ff1915881c92db57b3ec3b_amadey_elex_smoke-loader.exe
Size 5.4MB
Sample260423-1nt5qaat21
SHA256 a4b2d93997c601d437720bf18148044e12fccfd1a104d2c53602ed54b214bc3a
MD5 6645afbc20ff1915881c92db57b3ec3b
SHA1 2ff5e045faa100f986b5069e7503752dbb4e0538
SHA512 b533df2e9574614d44fbba12f414a380fcfc3653996e6ee0b5663fb34258d51576431e10d9543f58ae3a08ed6a4692e80f4235202e1641d6b045f84652c4f7c0
SSDEEP 98304:emhd1Uryes7VbitpkgVoV7wQqZUha5jtSyZIUh:elUVZwo2QbaZtliU
TLSH
T14946CF0586FCEE2EC91F01B5E0A122669BF1E964E7C3AF967C52F1F43943350B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
400	1D18.tmp

Executes dropped EXE 1 IoCs

pid	Process
400	1D18.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_6645afbc20ff1915881c92db57b3ec3b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D18.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 400	1032	2026-04-23_6645afbc20ff1915881c92db57b3ec3b_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-23_6645afbc20ff1915881c92db57b3ec3b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_6645afbc20ff1915881c92db57b3ec3b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\1D18.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D18.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-04-23_6645afbc20ff1915881c92db57b3ec3b_amadey_elex_smoke-loader.exe CA1BAD89F3F0472D2A83CC5F463B83EBF7CF401C4F4977CD38F6E2B4C8AEEF32493A28196DF748737142C596C475E726DB85E45BD854CFA596E51A861E608604
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1D18.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D18.tmp
Size 5.4MB
SHA256 a022cd0b03c85411c8bd05c4a8065357c280ef8b7e8d978d3ddbd9b51f028a32
MD5 f8f5445596935b597531a1bb32587cd2
SHA1 14590eed039ba66bbc00e19cb815ccb62da337be
SHA512 dd19366479748dcc743be51c82ee0a27fc423eaaaec29b9becf24ab68f9bb9f67ef178336a370f069aa62cee3363f5528829c1eeeddf6dfeb9e5c97df5694e7c
SSDEEP 98304:emhd1UryevCcy+/Wha2wb2vnV7wQqZUha5jtSyZIUh:elPXIhVPvn2QbaZtliU
TLSH
T1CE46D00586F8DF2EC91F01B5E0A122669BF1E964E7C3AF967C52F1F43A43350B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/1032-0-0x0000000000400000-0x0000000000849000-memory.dmp