7d568befbc045e9e021a40ae100e91704d60c48b876a8529a88be65a6ed103d9

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_6752e4dd4351d598edd66e458f44e2a7_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260507-ppynradz3s
SHA256 7d568befbc045e9e021a40ae100e91704d60c48b876a8529a88be65a6ed103d9
MD5 6752e4dd4351d598edd66e458f44e2a7
SHA1 d267f7611d862f5590cb1a4b861f158a56751470
SHA512 8d71bc9b55c8cefdf2be8ce2ca017b3cbc50343eddb23778c146afd610ac151324b1b953c9efbbacfed529611365d652f64b01d3e3dd11eea956c0f66ad18005
SSDEEP 49152:Qoa1taC070drB9q7HCkCOCqXvpMMRjKOCzePsl+A+F:Qoa1taC0Q9qT5gepMsXC2s+
TLSH
T168952355FB94C272C0810AB0E1A2C7E698793E7D16519D87BBC81B3F29E0EC05B72B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4964	EC0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4964	EC0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_6752e4dd4351d598edd66e458f44e2a7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4964	4952	2026-05-07_6752e4dd4351d598edd66e458f44e2a7_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-07_6752e4dd4351d598edd66e458f44e2a7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_6752e4dd4351d598edd66e458f44e2a7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\EC0.tmp
  "C:\Users\Admin\AppData\Local\Temp\EC0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-07_6752e4dd4351d598edd66e458f44e2a7_amadey_elex_smoke-loader.exe 56BDCF5AE3F55DFF058059FC0F9E41815DFB663662193E0A55F2008A19BAB30169C9BF1B14D1C900B4C32285A5F6F9776E7879C4258E452915B8AB06F9ED2A5C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\EC0.tmp
Size 1.9MB
SHA256 fa206a4242a467b41cd07ff276776fb3e23158f2e729000b6ca94f2109146cf1
MD5 1575a40a5f6e4bfe2e8e7d1578cb3a66
SHA1 9223d393a9af41b111b4593406c5701f8abffde8
SHA512 f6a3d257b2d1e2b49fcbac544258040df655236d21d3ee221165e033c32f82ad6f39f08fae1b855e7871abe28762cab32c61b454895c8067a2fb62342087ceb7
SSDEEP 49152:Qoa1taC070dGPHBgPgJAgON8YQj0696yX:Qoa1taC0bPhmuj06BX
TLSH
T1A4952211FB91C2B6D0812A71B691C3E798693D7D57418C837FCC2B6F2EA0EC06662797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4952-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4952-5-0x0000000000AC0000-0x0000000000B7F000-memory.dmp

Download

memory/4964-6-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4964-7-0x00000000009D0000-0x0000000000A8F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads