fdf992382b522c52f257b41978518c22a08c22c8dd344f1a8d3bff1181d87a52

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_c0fbfa1283d0527a912dddc656707853_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260720-azqcsscy5z
SHA256 fdf992382b522c52f257b41978518c22a08c22c8dd344f1a8d3bff1181d87a52
MD5 c0fbfa1283d0527a912dddc656707853
SHA1 65b4ae689bc49b237408e3f94f92e11c80972c9e
SHA512 cdd94b5de01a9693f1a475d17211054860d0368a9d60cce467fcf39b602833a9e9885ab9c4b17a4e624ee2200b765b72616c96ec1942ef6f5a5f39c9a5773a6c
SSDEEP 49152:0oa1taC070Uv/33lrK2OVFkCkLc6nz3DuD:0oa1taC09NrKT+CWzzuD
TLSH
T198952221F791C1B2C4820A71A691C7E2DC653EBD96428C877FCD1B3F19A1BC16A72B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4360	558D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4360	558D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	558D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_c0fbfa1283d0527a912dddc656707853_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4360	1504	2026-07-19_c0fbfa1283d0527a912dddc656707853_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-19_c0fbfa1283d0527a912dddc656707853_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c0fbfa1283d0527a912dddc656707853_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\558D.tmp
  "C:\Users\Admin\AppData\Local\Temp\558D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_c0fbfa1283d0527a912dddc656707853_amadey_elex_smoke-loader.exe 8610E98A2164E0077BDB0BDA976915316649859DED5B7739AFB2B955558644BEFFF6F79735924B32040DBD4B4D5ABB14C211724CA82F85E7998126BE48C6BD68
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

558D.tmp

Path C:\Users\Admin\AppData\Local\Temp\558D.tmp
Size 1.9MB
SHA256 0cb3cf05823011d9998528296362a081d99163455c4a96b04382b1ba9d009380
MD5 08f85215c8a673aabdbb603c7c06861e
SHA1 d9f901adca0042563af397801ff8d15d6b91d19b
SHA512 0634ea79de6f032c500ba6a22a3551662aab9582ad8c0b174a88a28af4e61e901b82f17db9e3aed5d0da8e0aab2f25dfb9290a7327dccbec1cfad57009593999
SSDEEP 49152:0oa1taC070UWURl6xLIkATY060qfbR5u:0oa1taC0VlOLd44bRU
TLSH
T175952310F795C2B2C0810671A5A2C3E2D8797D7E57818E877FC92A3E2D54FC06A72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4360-5-0x0000000000400000-0x00000000005E6000-memory.dmp