0b8d81351f78c3576dedb3fa95dce309aa81adde6ed5d5d7d23c0b72d58dc969

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260716-e5aazsgv8v
SHA256 0b8d81351f78c3576dedb3fa95dce309aa81adde6ed5d5d7d23c0b72d58dc969
MD5 4424f7675d4455941966b28136f32f28
SHA1 f5fee17b4ff8fea60e5ad6315efd1a7852b3f873
SHA512 725a2dff245398eb13403098914ea3d9c67a86c186d7de51e0557003b9867bd54a9f22ccff9753b7d9ba1c41797e99c0e59576ceed8dd36c69424d533809368f
SSDEEP 49152:Svm2AC0d1XqrdryeJVW8QmxQKy2QQ+YDZZEgmyYZo/wLVT5dVXeQqZUhh4r5VC9j:emhd1UryeS8Qm5WamFV7wQqZUha5jtSn
TLSH
T1CA26D00996FCDA2CCC1F51F4A1A51145C7F0A564EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3012	505D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3012	505D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	505D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3012	3940	2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\505D.tmp
  "C:\Users\Admin\AppData\Local\Temp\505D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-16_4424f7675d4455941966b28136f32f28_amadey_elex_smoke-loader.exe 0A54B2F9B3B9B573B54B68F21F67162CFD892EDE6EB25D31E027BE0FE76074DAF46A953C3C91D9C12F20ED748231C3284FF9BCD7544F6BD6A7313D249CA7D1E2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

505D.tmp

Path C:\Users\Admin\AppData\Local\Temp\505D.tmp
Size 4.4MB
SHA256 90b013a4767ac20d499809ca3f4e271e6b02d70c296de70c0f12dafb2631e993
MD5 782f5708cd7ec1e5c102f3365189448e
SHA1 309647af250ed9f5ff226046cc0506af53051fe6
SHA512 4943a1b3132802ae0833a89c35977cecdfb4f4e234b2fd74b20930441bf7239a1d8e5912ca6898972a65273cdec4f15779bd78fb024848416351f333fd256591
SSDEEP 98304:emhd1UryeRj6yEROX7uGfMbV7wQqZUha5jtSn:elxpERekb2QbaZte
TLSH
T1FC26D00996FCDA2CCC1F52F4A1651145C7F0A564EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3012-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3940-0-0x0000000000400000-0x0000000000849000-memory.dmp