8cc9db3582a9b868e6634b677005c7df3349f3d26405691929299656bed1f71f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260715-e3d66aev2y
SHA256 8cc9db3582a9b868e6634b677005c7df3349f3d26405691929299656bed1f71f
MD5 aa56d615b24089f96b3baec688b6b315
SHA1 00ee82221a83a3fa02618d61996491576271d410
SHA512 1bb0bccb7d31cb0e3ad308cd7420085dd71fd96fe4bce479e697e1a2f3b1e59e775a7f23b008bca389bb86555badd5510f1726afa663d9ab566ee641e916be36
SSDEEP 49152:Qoa1taC070dQ71pnDhSM9e3R5UZ9w5NYZEfcIqF:Qoa1taC0FDoMCJN9cIqF
TLSH
T13A9523A0F795C1F5C4820672A191C3E2DC6A3D7D86429D83BBCC2A7F2DA4EC05A36757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4556	29CA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4556	29CA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29CA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 4556	2852	2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\29CA.tmp
  "C:\Users\Admin\AppData\Local\Temp\29CA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_aa56d615b24089f96b3baec688b6b315_amadey_elex_smoke-loader.exe C435466007F9366D81E2338380900472E15B757B030FF8503C1E023A56395DD2D76E0F8E03D29B96347628530C1EA46404159184B7955BE9996E4E5ADC529BC9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

29CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\29CA.tmp
Size 1.9MB
SHA256 d422ea98e1595ecc6a9854447160e1d6b16271e425052e651cc22f6cd38e8b6a
MD5 e4395a245a9672bf76ae49934201d9fc
SHA1 a4d2785121ac27ffadb009a6b42139ff4c767af2
SHA512 8d8e9a8147eff4d80f612cbf3220b68f0e5e18fd588f7041a9c8a21b4db6947b62dc20823187ea9442e2a1df0a920420c659c61bff9ce076345eba15b740463d
SSDEEP 49152:Qoa1taC070dcV/ao2m6CIfpLJyKd7NjZqtxSJRjdRM:Qoa1taC0fV/T2mlecKd7NjixSJRjg
TLSH
T152952354FBA1C2F2C0954A71A652C3FB9C653E785A419C837BCC1B3F29A0FC46672687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2852-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4556-5-0x0000000000400000-0x00000000005E6000-memory.dmp