d803ef749afb32c0ef39333e83ffbc42e78e2e8f9a8817a6d8efa568cd4a9d15

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260714-w8l8dsbs3r
SHA256 d803ef749afb32c0ef39333e83ffbc42e78e2e8f9a8817a6d8efa568cd4a9d15
MD5 be22486784dc33805ef6c9de3da1139b
SHA1 201352c4a17bac794e03cb611bc1f9c6592d40f5
SHA512 89e76f723a0b34d309a8c74293b088f2a61ae4ccbe30966049fb4f739eddb997399e7320b533ce9a5b0d6eb7d6e827f6d0a6f14414dda003e02357507a3681ad
SSDEEP 49152:Qoa1taC070d/DHlK2DHWwQaj+8KTK5hof8p2PHQRkQ5WOuw:Qoa1taC0sD0pp84q2UpTRx4Ouw
TLSH
T169952260E7D5C3B6C4810671F562C7E6D8786EBC52058C832BDE1B7E2E50EC06B62B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4604	1C8C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4604	1C8C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1C8C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4604	3004	2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\1C8C.tmp
  "C:\Users\Admin\AppData\Local\Temp\1C8C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_be22486784dc33805ef6c9de3da1139b_amadey_elex_smoke-loader.exe A0F8AE04F398A89F2CF73A4A17E16AAC7978608695C82585CCBBEF5802B2848C01C8B7DCBBB91892B6C0C2532341B3DC4F657C21A5154AF0283A8331F1D175B8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1C8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\1C8C.tmp
Size 1.9MB
SHA256 5ec662b519668bd4dd7b486540e848cd73589675c820bc8c3d5b6d243815d6f1
MD5 15ad85f9fab4a8ff4e42ae6d0e45cf09
SHA1 2f22374fcc1077be0ee8b6b2eaf529f1381776a7
SHA512 30ec77117524efea19812300926bca70efec4df22cddabb8e1e603429d47b364be91dd63c9f4920c711827c3ca416f55916b1e94a1b332a4d13523fedbdc462d
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dOuP8Q+5GC2Z+6lZtFwk3xQP4QB7RQOYUx9Tc:Qoa1taC070dOuU9wC0+2eky517FvE
TLSH
T169952310F781D2F2D4810A71A5A1C3F2DCBA3EBD96119D837FC90B6F2990EC066A6757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3004-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4604-5-0x0000000000400000-0x00000000005E6000-memory.dmp