d19d6212b9a5ac410b60d184718b162a9d0d8d24a209ff6711e419f7539ad1a9

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260522-ryznhsd17q
SHA256 d19d6212b9a5ac410b60d184718b162a9d0d8d24a209ff6711e419f7539ad1a9
MD5 109da1839c4a32062bf253a5dd029786
SHA1 de05da9f49e3586cfe389ee74522d71d678bafbd
SHA512 9c684431aa4404733f13be0a1f5fc63babe93029c43f4ebea86c933ec508409feaa23270893155cbc51f2b1e7f3caec9a816aa9cbf222a54f71dddb9c61e6e75
SSDEEP 49152:Qoa1taC070d+rsRe+48y9SCpxkte+c+n0:Qoa1taC0lIRe+48yZHkteu0
TLSH
T11C952215F795D2B3C0820671B696C7E29CB83D3957415C83BBDC1E7F2AA0EC02A76A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3556	4AFE.tmp

Executes dropped EXE 1 IoCs

pid	Process
3556	4AFE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4AFE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3556	1216	2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\4AFE.tmp
  "C:\Users\Admin\AppData\Local\Temp\4AFE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-22_109da1839c4a32062bf253a5dd029786_amadey_elex_smoke-loader.exe C2F9D52C09C83952681EDB7561F141D0D90C13874657054CEE57772102EBA49C42E09458943632F159C58EE924DBDCBD9CAFC58F8331188C57447ACB6E0DA6F1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4AFE.tmp

Path C:\Users\Admin\AppData\Local\Temp\4AFE.tmp
Size 1.9MB
SHA256 695c6156173a4b5930728bba37f701665c2c9248e6d2b305ac1b7eb11c5d85ee
MD5 1f1716fc02181c8850857627ae6c9274
SHA1 49e8d763a7fde2e9b3ee781bc32c28b58a333806
SHA512 173e2faf3436a0564841d9103ae5f1a59698c3851fe7358c621b1dd3a4a6905d0ae9918841410de1069a7822af17120120cb279521ac2f749ee52999b434c51a
SSDEEP 49152:Qoa1taC070dH3ziDNEHq1X9oH3nk5LpzGvTDr:Qoa1taC0+i2q1XUXILhOTDr
TLSH
T1EC9523A0F395C2B5C0810AB1A542C7F6DC792E7C57409D87BFCD1B6E28A0ED06A76B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3556-5-0x0000000000400000-0x00000000005E6000-memory.dmp