3b0ee4773d7c76b2eb31d8a0f838e7516b09230a7506a63454325d4186269b61

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_a1e6ecc6034b9e83a5468791f882b99d_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260701-j39ehsby6w
SHA256 3b0ee4773d7c76b2eb31d8a0f838e7516b09230a7506a63454325d4186269b61
MD5 a1e6ecc6034b9e83a5468791f882b99d
SHA1 fb6ff29dabffc0eabaaa06e1b85c0af3209ea28d
SHA512 4018fc6c54a101e0e2c7cfd9b936938264c45c2ee7e50a35a85d88bf452ed7bd053639ee60fceaebf4abe836f6e4873ea0ddcb2a180c2e18c65ef95460f1bd38
SSDEEP 98304:emhd1UryeHc/kOt3mkqQ+FgrUrQV7wQqZUha5jtSyZIUS:eln2kI3mrgrT2QbaZtlir
TLSH
T1F356BF05DBE8EF1FC91F03B590B2222657FAD494E783ABD6A941F5B07E82350BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5092	6EB3.tmp

Executes dropped EXE 1 IoCs

pid	Process
5092	6EB3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_a1e6ecc6034b9e83a5468791f882b99d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6EB3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 5092	4052	2026-07-01_a1e6ecc6034b9e83a5468791f882b99d_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-01_a1e6ecc6034b9e83a5468791f882b99d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_a1e6ecc6034b9e83a5468791f882b99d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\6EB3.tmp
  "C:\Users\Admin\AppData\Local\Temp\6EB3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-01_a1e6ecc6034b9e83a5468791f882b99d_amadey_elex_smoke-loader.exe 77EDD1301F242935EF2C33521A0BC47BACD049EB7B7012A656F5E6C6B6B066E3C6EAF1237703197B29AC3D2DD0FCB5D602C4B6FEAA259D447DE1E8C90BFE18CD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6EB3.tmp

Path C:\Users\Admin\AppData\Local\Temp\6EB3.tmp
Size 6.0MB
SHA256 6b75163d579cc32e27924205fe8cde131c8936f2d2e2e0c53209839f7d46ea9c
MD5 7cc7cb0ee8241e0378fec7babdd45302
SHA1 1604b7700bd82ccb3ca27184a5f9f69b153d253a
SHA512 83f7ebc93ca500a0928e15f6a8c45e4f8ad2ca7c229ad7387640d471522da00cdf267d4f19862f162918101a95fe589a5f3197fec802c8d6fb349849c83233bc
SSDEEP 98304:emhd1UryeNy6iAe4mUoIznKV7wQqZUha5jtSyZIUS:eltJiAJmUoIznK2QbaZtlir
TLSH
T17156BF05DBE8EF1FC91F03B590B2222657FAD894D783ABD6A951F5B07E82350BE02153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4052-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/5092-5-0x0000000000400000-0x0000000000849000-memory.dmp