af9655bab21155dc8dfe4b140f0180fa14932ee1f1ba8e64828f9d1fa3d44612

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe
Size 5.7MB
Sample260426-e1q3yafs8k
SHA256 af9655bab21155dc8dfe4b140f0180fa14932ee1f1ba8e64828f9d1fa3d44612
MD5 80229f7e5f509d1fcb26363a7f73b54d
SHA1 c0342236fe8caebcb4e4d38dd1d0c2435385767a
SHA512 840e9cc05d25f9949fe85a7b89e9ed6f242d2241b045db450a3dba43006d76c277ede8557b33b3d5a65141c4cc1eed5839d151182358fdcaff8cb18cc7dc9f62
SSDEEP 98304:Qoa1taC0uNgC7sLlGcVpjGcVpjGcVpjGcVpjGcVp:Qoa3qCglJTJTJTJTJ
TLSH
T16E568D1233F85A2AF0FF07B5783546904BF5F9512AA2DB1F19A16ADE1CA37418E52333
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2232	F9C1.tmp

Executes dropped EXE 1 IoCs

pid	Process
2232	F9C1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9C1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 2232	1416	2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\F9C1.tmp
  "C:\Users\Admin\AppData\Local\Temp\F9C1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-04-26_80229f7e5f509d1fcb26363a7f73b54d_amadey_elex_smoke-loader.exe E62B1CA7CA77A6B8BBA126E1CEC7E1479FD12F25BA573FF5A12F1E47E34FD599743841E4BB7F312B9D0A0A504F21B1A341EAB54D84C48790EA44716C2EA5C91C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F9C1.tmp

Path C:\Users\Admin\AppData\Local\Temp\F9C1.tmp
Size 5.7MB
SHA256 cdaae5d543588f11b04edfaad24804feb1d691b0775ce12f192ad852ed6a9c30
MD5 a7b7ef1d19e79de188548fea10f6a44f
SHA1 3849105c089692d11bccb854ff5e2b6c4e2e70f7
SHA512 01589b1a6b9110fe0fd7c41eb5b47dd3a59c4bafca6be7032354b954a9beec7e1f112550cd959aed2a0de15ef36f2c48ab0d3ab9061a0c90f302058d8a8a04f4
SSDEEP 98304:Qoa1taC0NPngbIW3GD5GcVpjGcVpjGcVpjGcVpjGcVp:Qoa30PndND5JTJTJTJTJ
TLSH
T156567C1233F85A2AF0FF07B5783546904BF5F9512AA2DB5F19A06ADE1CA37418E52333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2232-5-0x0000000000400000-0x00000000005E6000-memory.dmp