ea4b7bfb1b14fbae11eb721a930aa9e5cc25027542df573ef19b356716413460

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_33348a6e8c7db3ea22447fa7cfe23e6d_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260707-e5dcmshy4x
SHA256 ea4b7bfb1b14fbae11eb721a930aa9e5cc25027542df573ef19b356716413460
MD5 33348a6e8c7db3ea22447fa7cfe23e6d
SHA1 93db7de499c5a5e5d5f3a9d54c29c91c3d571074
SHA512 89f9a6eb2b8b93e860a20e68a4449345378e5783ac2e513d4025a34ba4fa4dccd83d4bc9aee076f4d941ebd1d680f6ae5fc2fab5163c223e2fa0a2998213c22c
SSDEEP 49152:ioa1taC070UPHQRmQfLX7djSSxqOsvGfwNVFEN5QvOJFIRU:ioa1taC0hHaX7d+S4Oo6wNzEL
TLSH
T125A50200F704F0F3C5056BB0769ADB5FA57029FB7745DC8B3988265B19CA9C8A712F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3540	484F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3540	484F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_33348a6e8c7db3ea22447fa7cfe23e6d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	484F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3540	3604	2026-07-06_33348a6e8c7db3ea22447fa7cfe23e6d_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-06_33348a6e8c7db3ea22447fa7cfe23e6d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_33348a6e8c7db3ea22447fa7cfe23e6d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Users\Admin\AppData\Local\Temp\484F.tmp
  "C:\Users\Admin\AppData\Local\Temp\484F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_33348a6e8c7db3ea22447fa7cfe23e6d_amadey_elex_smoke-loader.exe 6D8B45501C98CDED504110E7BAEC0B19AFDDE12FFE219D67D3C1F0AE77E2489127B93C8E9D34B648BC6B1F1D758BB9DCE18B88D959904B8F0663144BBC2164CE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

484F.tmp

Path C:\Users\Admin\AppData\Local\Temp\484F.tmp
Size 2.2MB
SHA256 021e0b73c6f79ca8878ac566f08d4b63e3bdd7c70e8d3b008bba92eb0f2acc13
MD5 f7a0e456b4ca2b3e856f16ac30d7c9da
SHA1 934cf8b7e5da6d098f87ae67d611cbcfbad28916
SHA512 3e1ec933752ce41ab593e929d9aa7783b83a409724d689099058ac4ef7e234988ce4ca76fd1bfec627116fd84708337b780d5432294204a7779a403dd9e0745c
SSDEEP 49152:ioa1taC070UAmr70QPhop/GJawSjdmB4UXzw3ORGyeIj/yQvOJFIRU:ioa1taC0CG70QCpqcdmCUXzw3Ev/E
TLSH
T1EDA50200B304F0F3C5056BB0665ADB9FA53029FF3B45DC877984169B19DBAC89B12F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download