4865b81da8e2bb731c0a50ea6be4f05ee184b37159c3c80c0b0d932f108dd9cd

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260718-ctsbbagy5v
SHA256 4865b81da8e2bb731c0a50ea6be4f05ee184b37159c3c80c0b0d932f108dd9cd
MD5 b8daefd10b8ef0706e2e83493be69da9
SHA1 015af2e8be76fb91daf148ee890c4e81470ee470
SHA512 ad80f655a5d1bee7b35d8a8254de428371e2bbb50eda60ca2e12267afc2805ab0ea941afa202bf04135ad384b716ba74461c76caf29e99cdd767c219bb86e292
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dLRf6Pi2j1F5sgIDs5qXZLYo6z8emuUYIAQLT:Qoa1taC070dLRfTOeYqCz8Tu4AymG
TLSH
T189952311F790D2B2D0C50671A592C3E3D8B93E7D62458C877BC92E3E2DA0EC4AA76717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2520	6ADA.tmp

Executes dropped EXE 1 IoCs

pid	Process
2520	6ADA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ADA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2520	4352	2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\6ADA.tmp
  "C:\Users\Admin\AppData\Local\Temp\6ADA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_b8daefd10b8ef0706e2e83493be69da9_amadey_elex_smoke-loader.exe D75B270AA138B5036550BC51E5DF92EB6E0A4E5DB9C1F28450419B82227E11AAD621B0F94258D15C0B444E949EBAA2DA9423A23A06E959964C36BAAB8095475D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6ADA.tmp

Path C:\Users\Admin\AppData\Local\Temp\6ADA.tmp
Size 1.9MB
SHA256 8352debd8049e37a8bf9c3ca38b2b45079f436a5fd5840db6c2480dd98cf5210
MD5 fa066d9885e1ff7a5362f32d06aab2e2
SHA1 98c7f648523d1d62bce0b3568b4dc21be1af14c8
SHA512 994b2c5426a3f2476b97a1c6b317624d2b46f8833982fe76b6c5ae3e18e3a8264fcd3945c5c3f110eb9b020727b7e2cfbe2dd05e08d12f38e7f5e058893dda22
SSDEEP 49152:Qoa1taC070djwgFVzA3SXt1AUzO2ay+pMfY5dTfz:Qoa1taC07IzA3SXDAUzRa3MfY3TL
TLSH
T166952254F780C1B2C4424634E562C7E7D8752E7817169C97BBCC2A7F29B0EC46AB2B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2520-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4352-0-0x0000000000400000-0x00000000005E6000-memory.dmp