52b583ab97846b2de007eb117600d1cd739c794b13db351ca9764730be7cdf07

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260720-ra2g7set41
SHA256 52b583ab97846b2de007eb117600d1cd739c794b13db351ca9764730be7cdf07
MD5 fe7fc3c8f3e139003282c36ddb3d0fb9
SHA1 f6eefa854b87840ab4a22d4ece57934c06dce4e7
SHA512 2ff9f2837be00d6c9f27b29daea2524364247ad3b07b21220be2d82d291a2eb98ba6c9e9b77a0742e458d37ac73ee20aff9557f3fa178a18ca5ee3b6b62e3b49
SSDEEP 98304:emhd1UryeNETU2I1etXVLUjH5oxFbxCVLUjH5oxFbx:el6TMetXVUjZEdCVUjZEd
TLSH
T184262380B7D4C362D1D275F9648343DAD9343F3E1276994B2FCE1A2EEC688E176B4252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4880	4E79.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4E79.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 4880	4348	2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\4E79.tmp
  "C:\Users\Admin\AppData\Local\Temp\4E79.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_fe7fc3c8f3e139003282c36ddb3d0fb9_amadey_elex_smoke-loader.exe C9BB2544CC592374FEE0CEC430F726ABF2F0BA913B9593691129C44C16CF1FD35F7A0C295BF889A802F8C70F68E7BCB1D6BC14CC686A2E46BB10A67F05F7DE0A
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4E79.tmp

Path C:\Users\Admin\AppData\Local\Temp\4E79.tmp
Size 4.2MB
SHA256 6d322d6f14416fe29a792a8bbd8922c9b5d1ed385ef35ec433239fd1a8e1e4f2
MD5 8810d99374734c43af5b780d8dc61693
SHA1 a9b4af63df4c118f01b81fcb5045634d3a650ac7
SHA512 98238430851df27db7de98f37f655270a38e3148e711cef8d07772ba9ba16f92cd3286e6d8c48e00c31f02804e79095c22a4b904ef246b52effddbc637a3c911
SSDEEP 98304:emhd1UryeqB2jXQhn8o01HtVwXVLUjH5oxFbxCVLUjH5oxFbx:elKB2jXQhJUHt+VUjZEdCVUjZEd
TLSH
T1DD262340BBD4C271D18275FA648383DAC6343F2D5169E58B6FCE3A2EEC695E27274243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4348-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4880-5-0x0000000000400000-0x0000000000849000-memory.dmp