08c6d3159d0759b701644ab663dbb983e5f21f2fca7a85971cab0ea70464b94c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_3113816e75ae34692db1da2d0da23221_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260720-n3wwmsg16r
SHA256 08c6d3159d0759b701644ab663dbb983e5f21f2fca7a85971cab0ea70464b94c
MD5 3113816e75ae34692db1da2d0da23221
SHA1 5eca29d4c65caea7e36e6579fe57878d8ccaf201
SHA512 a4866cb65026397f46780a47dff13fa9ab15055f8140dbd018df094d4ab0a66393665472a883b1bdc007c19b7e0ba279a1576701671861c53a1c2349e30cf1ff
SSDEEP 49152:Joa1tHC070UjOD8BzEtzE9ayU1ZxH4ixPtwF09jap:Joa1tHC0lOD8Jl9ayUzOixAI
TLSH
T11A951259FB5880B2C042D4BAE5A2CB6BD573387967004DCF27918F6B1E27EC57631B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2708	2F0A.tmp

Executes dropped EXE 1 IoCs

pid	Process
2708	2F0A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_3113816e75ae34692db1da2d0da23221_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2F0A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2708	2104	2026-07-20_3113816e75ae34692db1da2d0da23221_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-20_3113816e75ae34692db1da2d0da23221_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_3113816e75ae34692db1da2d0da23221_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\2F0A.tmp
  "C:\Users\Admin\AppData\Local\Temp\2F0A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_3113816e75ae34692db1da2d0da23221_amadey_elex_smoke-loader.exe 19C841B9EBE1A5C00FB715187FDBB54BE2E4752B7711C08A163702B87048B06D346997AE8829BCA64179C1A318C6F5A4C60030F5D95C3C336C8F5C025FDA86AC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2F0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\2F0A.tmp
Size 2.0MB
SHA256 e7c0fea5634e875f15ca7c19189d3aa43b1dd7c8b6410ca70ac3147bcabd69e1
MD5 ca5d138b50864c4a7d82feb86644e1c2
SHA1 e3e58a20f415addef50b2b56434388651a1b2927
SHA512 c26dfb0d11bf304723b4dfa9054297cdfdc454b3a7c098c33df8dfaf79d62819bbc486dab9336b7c7d840ad4483a8f65eb913cff33f751af28cac4d4e13ed015
SSDEEP 49152:Joa1tHC070UBgmGyAYWQgV6nCULg2KXux4cp:Joa1tHC0jDGZx/VQC4g2Mu
TLSH
T129951219F75881B6D091C4BAE6A2CB67D473383653005ECB27958F7B1E27BC2B630726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2104-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/2708-5-0x0000000000400000-0x00000000005E6000-memory.dmp