27546a7536d4d162af479998f826d5b2d2c37ed0d603e1dc60e202d7f409596c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260717-2pgfpaf16q
SHA256 27546a7536d4d162af479998f826d5b2d2c37ed0d603e1dc60e202d7f409596c
MD5 60531c04bbbf312d1a0c18ce52aa6bb6
SHA1 04341f2bd8d8211e35b95c11ca035cab45330ddc
SHA512 e5c2447b869ced691ff10c02b6595b115065349490d0cf1aac5ee7d84220a53d293e64823c43d74f0fcaa7c70eaa05935ea319e575b105c9b26759a43af4fb9b
SSDEEP 98304:5mSWOiIyUuviwQzRY3VE5dVLUjH5oxFbxx:5XyQzRGS5dVUjZEdx
TLSH
T1B8E52301BB95C271D08164F9615383EBD9743F7D4622AE873FCA2A1EDCB89E17674283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
624	1E70.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E70.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 624	2196	2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\1E70.tmp
  "C:\Users\Admin\AppData\Local\Temp\1E70.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_60531c04bbbf312d1a0c18ce52aa6bb6_amadey_elex_smoke-loader.exe 60AF53126F97A64F9E8630FDE86506AD914CD3FE3832FA53B8B0DA2D040ABD6D2B44AE37F0F347C5BC7BF19C91E9FDDB3AB73A40F2786AE5E3E198A409B1FDCA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1E70.tmp

Path C:\Users\Admin\AppData\Local\Temp\1E70.tmp
Size 3.1MB
SHA256 14a26c7728e700433f8418ed6828d1606c8e106421228bbea8327e5f69f79291
MD5 83c0e9a1d69a20bf31685bbb3b20230c
SHA1 883a1ae69db988269058ffa728ab4f7c6d7f3dbb
SHA512 9c39c14e8e1e2952db59f861c23779e14e1e0a1b5f43d0ab5c32120db14a2cbc69a445764baaa127f10acfce31a25c86c2b50ce9541e1ae4c75684111f7e4cc6
SSDEEP 49152:Fvm22OdWOXqrbIyUJG8+y9oJva/fF/zGxIFVLwLVT5kUvgJSgHT6ojkxFbxLWC3F:5mSWOiIyU3fl3Y0VIVLUjH5oxFbxx
TLSH
T106E52350F7D5C2A1C09264F8608743D69D783F7D46299D873FCD2A3EAC689F1A236253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-5-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/2196-0-0x0000000000400000-0x000000000071F000-memory.dmp