a0fcba2aa0233eda857fa98ae99bcbaf5c728284cfa470a22c9289e1035cf9bf

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_45978a3155632cc08f6c162e8732f9b8_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260702-2ttltaf18t
SHA256 a0fcba2aa0233eda857fa98ae99bcbaf5c728284cfa470a22c9289e1035cf9bf
MD5 45978a3155632cc08f6c162e8732f9b8
SHA1 d727f3940a4cf9171226090e44b753257be6df2f
SHA512 b237536a5b76150002eb4dd0964458e7ff1d59b7caffc0006fecd464a4769e861a2e4ebd31fed74f70bb5fe9f59823d1b40b11340b887233cf296a7202d274a1
SSDEEP 49152:4oa1tKC070EOc6azzhacAarkoOjip2PUxBs:4oa1tKC0oTa0cfkoOji/Ds
TLSH
T15C952350F790C2F1D4C11A71A9A1C7F398293E7D8A464D837FC84B7E2AA0EC49A72757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4804	717D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4804	717D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_45978a3155632cc08f6c162e8732f9b8_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	717D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4804	2576	2026-07-02_45978a3155632cc08f6c162e8732f9b8_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-02_45978a3155632cc08f6c162e8732f9b8_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_45978a3155632cc08f6c162e8732f9b8_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Users\Admin\AppData\Local\Temp\717D.tmp
  "C:\Users\Admin\AppData\Local\Temp\717D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-02_45978a3155632cc08f6c162e8732f9b8_amadey_elex_smoke-loader.exe B4645EF28B0EBEDDE52EF98778FAB51AACAF6142BD20E1DE479B09847662F771A492CADD6C62ECA86239A1CED607A0E66264E7B08A1EB30E61C84913F84C8DF1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

717D.tmp

Path C:\Users\Admin\AppData\Local\Temp\717D.tmp
Size 1.9MB
SHA256 e20ee4f8b2aba7e44e59c307c80336f7f17ed0c27b3d94603c1669b119524987
MD5 2268e4bd6d6a66e6f93cc5cd7da8270b
SHA1 5e903787fea5a66339cfd30630285c7a1248e5ca
SHA512 bab714f9d9a78912f456552b76622eadb43621d098ac4cd73e644a4f483e45d41449e6200c7ae281d9dcdbd2423f3095c15433ff7c9c52f9b0091629bbf6f3d0
SSDEEP 49152:4oa1tKC070EpBCJw36844jHGxFjdJGshfD:4oa1tKC0LQmjmXjKyD
TLSH
T137952254F794C1B2D0925931F1A5C3E2D8787EBD4B818D83BFC81B2E69A0EC05A7974B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4804-5-0x0000000000400000-0x00000000005E6000-memory.dmp