74a4e3ee2adc187608e58f56dd6517d4ab9e29b620aa0dfc285cba189258f7f9

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe
Size 3.1MB
Sample260720-kcsvhsbv5q
SHA256 74a4e3ee2adc187608e58f56dd6517d4ab9e29b620aa0dfc285cba189258f7f9
MD5 ec42a62c62af76946d70da6cec8717a0
SHA1 521ed2a35ffb45861cccdf7a2aa18b8a95d67ab5
SHA512 f0704495c851481b82547cc140804de2159352f8372c77e350fdb4c77020233b23b6c2b67d181cf748573ed81b2682de7a3e7111675c29b93f6bc79e6bdd033e
SSDEEP 98304:5mSWOiIyU8n/+frO0En24IeVLUjH5oxFbxx:5XNjOQHeVUjZEdx
TLSH
T1ECE52351B7D4C2B2C08225F9648343DBD5783E3D1256988B3FCD2A2FA8A89F17779643
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1672	8FB8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8FB8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1672	1856	2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\8FB8.tmp
  "C:\Users\Admin\AppData\Local\Temp\8FB8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_ec42a62c62af76946d70da6cec8717a0_amadey_elex_smoke-loader.exe 31896334C050E0159345F233C738FB4442095990E1D6387B8FC809FDAAD414AE35A4DAA489675CE8F5566E2F1CDE6F145958AEA6D9D244F014FCD3DDE74F2B51
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8FB8.tmp

Path C:\Users\Admin\AppData\Local\Temp\8FB8.tmp
Size 3.1MB
SHA256 6e711ca9a96f08e0e78e311d84cad08ed333805dba4cba992a767bc994ebcbbe
MD5 515b5ae1b973add1c0dfa5be82985c5a
SHA1 d7a34c1bf4a8c50bf4f40adfcaff4e837cb47c54
SHA512 eb0b96208559b50c68f65fa15b1ad2d1976ef8637983fb4fc08f9638176c95eaf6dcfe6c435a95c4adbf3c07c8f9037b880f65e337d6cb7ce9fd70f57dde234b
SSDEEP 98304:5mSWOiIyUd2aoA36oPhcwQoH7fI9VLUjH5oxFbxx:5XP2rA3HtQobf6VUjZEdx
TLSH
T1F6E52381F785C271D18126F5669383DA98787FBC1121598B3FCE2A6FEC648F27235A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1672-5-0x0000000000400000-0x000000000071F000-memory.dmp

Download

memory/1856-0-0x0000000000400000-0x000000000071F000-memory.dmp