Analysis
- max time kernel
150s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
15/07/2026, 04:36
General
- Target 2026-07-15_90c7063d350f6dee0a12dbc47d676bbc_amadey_elex_smoke-loader.exe
- Size 7.5MB
- Sample260715-e8a2pabx6j
- SHA256 d892db7f4d758c94aed3cfe44999b3c293da2af6646a23d90a4e6222d640cdb4
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_90c7063d350f6dee0a12dbc47d676bbc_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_90c7063d350f6dee0a12dbc47d676bbc_amadey_elex_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6A6D.tmp"C:\Users\Admin\AppData\Local\Temp\6A6D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_90c7063d350f6dee0a12dbc47d676bbc_amadey_elex_smoke-loader.exe 434C0C620CD13EED35AF10B00EC92B7B0D8D8C01B74FD2790BCF105901C237CE7C1F2560FB98ED258E9DB06565CC7F62C5661B8B2FE6453B0E870E3DCB62586A2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
6A6D.tmp
memory/3512-12-0x0000000000400000-0x0000000000BB3000-memory.dmp
memory/3512-13-0x0000000000400000-0x0000000000BB3000-memory.dmp
memory/3760-0-0x00000000005E6000-0x00000000005E7000-memory.dmp
memory/3760-2-0x0000000000400000-0x0000000000BB3000-memory.dmp
memory/3760-3-0x0000000000400000-0x0000000000BB3000-memory.dmp
memory/3760-4-0x0000000000400000-0x0000000000BB3000-memory.dmp
memory/3760-5-0x0000000000400000-0x0000000000BB3000-memory.dmp
memory/3760-11-0x0000000000400000-0x0000000000BB3000-memory.dmp