3f8e2e087dca23965688b10e254021c78ad2a95c180d9ca7725ba385251469fa

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_8e6727b8b9e27f96ba881b130a02b5d8_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260707-cteefsc16m
SHA256 3f8e2e087dca23965688b10e254021c78ad2a95c180d9ca7725ba385251469fa
MD5 8e6727b8b9e27f96ba881b130a02b5d8
SHA1 765da3ea92cd48e2270a0b8e545ece8202437f4a
SHA512 4b0ab245ebac0f05855a8b2ee5cd344833f137b8055b0a2228e8605ed142dd91a3de0451915f218aa4ed802612689781bf7a84c63c5ac3a8ac77d0492ffd0bd2
SSDEEP 98304:emhd1UryeJ6tmfVbaD0IV7wQqZUha5jtSyZIUS:elAQfkD0I2QbaZtlir
TLSH
T19F56BF05DBE8EF1EC91F03B590B2222657FAD894D783AFD6A951F5B07E82310BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4748	4244.tmp

Executes dropped EXE 1 IoCs

pid	Process
4748	4244.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_8e6727b8b9e27f96ba881b130a02b5d8_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4244.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 4748	2136	2026-07-06_8e6727b8b9e27f96ba881b130a02b5d8_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-06_8e6727b8b9e27f96ba881b130a02b5d8_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_8e6727b8b9e27f96ba881b130a02b5d8_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Users\Admin\AppData\Local\Temp\4244.tmp
  "C:\Users\Admin\AppData\Local\Temp\4244.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_8e6727b8b9e27f96ba881b130a02b5d8_amadey_elex_smoke-loader.exe F6D28D5996CA89CFB80A3C90F420215DBD3353328285C95CAB65AF7ED4355F71C3E8EECEAA014C0F297D4C0E71C12DE443A86E28275BF9BCBC9CDF24BDC8085D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4244.tmp

Path C:\Users\Admin\AppData\Local\Temp\4244.tmp
Size 6.0MB
SHA256 2d355891116f097c89caf1620a516fb9afffba0d16a382e61384012bd34b277a
MD5 d09bcc1b90103dbbe2b3e383adf69755
SHA1 1d08a0285a10ef88bb650f839d1a4092977c8daa
SHA512 2794603bf1be2fcc612991379fe99c4f84931cee9f0cc2560a70d03634f1b3557de694a6c2209366fb45e293abd1f7dbc796c0cbb7eca0f369e7e263d5abe539
SSDEEP 98304:emhd1UryeFZLQ7o6kYjcxnDxKHpQMMisULV7wQqZUha5jtSyZIUS:ell9skjnDxWQBisc2QbaZtlir
TLSH
T16C56BF05DBE8EF1EC91F03B590B2221657FAD894E783AFD6A951F5B07E82310BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2136-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4748-5-0x0000000000400000-0x0000000000849000-memory.dmp