0ec5fcad1be89ee60935f99158da12fd6c63550273c6dc298b5d6f3ef0b4eda1

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260719-b9a7ascs21
SHA256 0ec5fcad1be89ee60935f99158da12fd6c63550273c6dc298b5d6f3ef0b4eda1
MD5 923d74f01aee52a867aad4184fe3760f
SHA1 46abb642676cd279ff6b4d7ff4a971db18bb3fa0
SHA512 339ee7a06926dd426df4b8d4c02c312ce7b2b714f7b31e28e52bde4faa0d9fcecbc679fa2e6d870e52a319b35bd611860bb3147d4b29200ff8e429cfec1c8ab8
SSDEEP 98304:emhd1UryeYdD5YFVZ3FYGl9kVc5VLUjH5oxFbxCVLUjH5oxFbx:elsD2FVZmjVGVUjZEdCVUjZEd
TLSH
T11A262391F7D4C261D1C235F9648383DADA343F3D5139994B6FCA272EDCA88D672B8242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3124	4939.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4939.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3124	2948	2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\4939.tmp
  "C:\Users\Admin\AppData\Local\Temp\4939.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_923d74f01aee52a867aad4184fe3760f_amadey_elex_smoke-loader.exe E11DBDBD60873F12CB4E912C694F1530D2312626006E6C0B9427373E1E04BE4D76F68961CB9147E4496DA4274FF086551978A273B95570F0B5D287484EAA6DEA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4939.tmp

Path C:\Users\Admin\AppData\Local\Temp\4939.tmp
Size 4.2MB
SHA256 d2abb2177eb39a26798f54a92b18b65ef775037a76028ae24369fc42c2acc882
MD5 a7d2a1602b330613eac1372f63c3934b
SHA1 818eede1a73ad4f8bc1bbc87c6aabc56d5bbfccd
SHA512 d98c1e1044ec17004db4407db1436a4feb7378a60b61cd6e1805a0402c54f22222bfd4f99b3eb9f51684d193ca2221f812e342b073a5fb5fb91885f6c2ef9379
SSDEEP 98304:emhd1Urye/ANU0SwGdNiVLUjH5oxFbxCVLUjH5oxFbx:elfyU0tGdNiVUjZEdCVUjZEd
TLSH
T126262340BBD4C361D18275FA648343DACA343F6D4576998B6FCE2A2EECB8CE17274152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2948-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3124-5-0x0000000000400000-0x0000000000849000-memory.dmp