cca32a69493eeb6a10f34f02d2632548e620e2531799e8d646ff82bc632dfba8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260717-tts2aaa14x
SHA256 cca32a69493eeb6a10f34f02d2632548e620e2531799e8d646ff82bc632dfba8
MD5 f8ed649aa879de82083052785763de0e
SHA1 14a94c35c4d05d0d799f0e5bd357759e2396e1c6
SHA512 d09ceaab66ccd182635295b1223a6fcd7fe76c4ae21714c4db008399ccc9ad498f4b1bc7b09b785176ba3da32d251b3807e18c7d44205cbf0733d5b8d1358a98
SSDEEP 98304:emhd1UryeqEjcvvJz4AH0p9n9VLUjH5oxFbxCVLUjH5oxFbx:elKLvvJnUp19VUjZEdCVUjZEd
TLSH
T16D262340B795C261D1C238FD648343DAC6783F6E5175A94B6FCE2A2EEC684E27279343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	3505.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3505.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2340	2756	2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Users\Admin\AppData\Local\Temp\3505.tmp
  "C:\Users\Admin\AppData\Local\Temp\3505.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_f8ed649aa879de82083052785763de0e_amadey_elex_smoke-loader.exe 624DADA8F7F1B3318636B4F8D6869E8BF350F9B9BB1F144397C3E71CB6329A3FC3CB46F6A2FBFEEFDC573A72D449B6422367BE4F3C2A1A46D02803BFED7C1E8C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3505.tmp

Path C:\Users\Admin\AppData\Local\Temp\3505.tmp
Size 4.2MB
SHA256 02fa2028006a15a991c8f781d77183e0bb680f3b2067787dad7681cc3a6176df
MD5 8bf334f2815437cf7a7d5aad8a85ce54
SHA1 7b69509e0dad902b1880293780ad79e842c4a04d
SHA512 03b819f586b731de9e8323850c1c43d3e01b214cc7b50d58df46aef38cd1eb8c8725848e724b43fde88ecb4d473c46df7fd6eab4aa31ef25cff5ea30cf7c3d75
SSDEEP 98304:emhd1UryeNR81wKpdXgA/rMVLUjH5oxFbxCVLUjH5oxFbx:elLHA/rMVUjZEdCVUjZEd
TLSH
T1D5262340B7D5C372D18275F964C383DAD9383F2D1536958B6FCE2A2EEC685E27278242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2340-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2756-0-0x0000000000400000-0x0000000000849000-memory.dmp