bfdf92d896fe8d496ac5af43c4baaafad477afb48964a60eb9c32cc87bdf530c

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_c982287c51c49acfca7d1ce8f34c320e_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260719-xbchcsby31
SHA256 bfdf92d896fe8d496ac5af43c4baaafad477afb48964a60eb9c32cc87bdf530c
MD5 c982287c51c49acfca7d1ce8f34c320e
SHA1 44d5033c3aa52e0278e7a33650cafc98f248f0ec
SHA512 65c4fde37b70fd983851cc7e19f8dab12acc710af8a042fbba48e836fd2ba7e3b5420bb4c969075cdfcab5c7328b9c4990841baac8757c024f536e19b139f494
SSDEEP 98304:emhd1UryenZd6a1enEftDkeoV7wQqZUha5jtSyZIUS:el5dboP2QbaZtlir
TLSH
T18156BF05DBE8EF1EC91F03B590B2222657FAD894DB83AFD6A951F5B07E82310BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1704	4A81.tmp

Executes dropped EXE 1 IoCs

pid	Process
1704	4A81.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_c982287c51c49acfca7d1ce8f34c320e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4A81.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3916 wrote to memory of 1704	3916	2026-07-19_c982287c51c49acfca7d1ce8f34c320e_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-19_c982287c51c49acfca7d1ce8f34c320e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c982287c51c49acfca7d1ce8f34c320e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Users\Admin\AppData\Local\Temp\4A81.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A81.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_c982287c51c49acfca7d1ce8f34c320e_amadey_elex_smoke-loader.exe 98D04C363DD586135B0702E68C4E3DB8E866777D06F666EA53AF550E649DCDDBA4C9C2472C3A5CDF6A76C0663D0D074569E38538D7325F1FB89ACA9BAD2309E8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A81.tmp

Path C:\Users\Admin\AppData\Local\Temp\4A81.tmp
Size 6.0MB
SHA256 9fe0f9f947ed1b36c39e3169a1d5037f5590f3f2d005bf524b741436a27a5151
MD5 3ad44509a6d38203f5417cd968fd7d04
SHA1 56722bfa2fbb139d485720bd3142b4ca92cfb458
SHA512 2b8ab812639e1cdc3eac7cf75d528c0df3970a02d8bfe43488241ed09f9e869796513ca5759b256050c51c404b9e12afe88904d97d1d9ecdd38cd80151290c9f
SSDEEP 98304:emhd1UryeGibhMlOojzV7wQqZUha5jtSyZIUS:elmuKouz2QbaZtlir
TLSH
T14856CF05DBE8EF1EC91F03B590B2222657FAD894D783AFD6A951F5B07E82310BE42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1704-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3916-0-0x0000000000400000-0x0000000000849000-memory.dmp