dfe25e3fc7971350e6bec09c6110775bce4790e73c77a017f4dc12eb2c347372

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe
Size 3.3MB
Sample260720-wry6macv2y
SHA256 dfe25e3fc7971350e6bec09c6110775bce4790e73c77a017f4dc12eb2c347372
MD5 0ecc4a982fdaf310434c4dfaebf1c884
SHA1 99b872b12ada26ea1d706ec05d96907173dfb7d8
SHA512 0c7b39d2bab7c55168d8c618efa7b35fa6666a380e21ee4b465d21f53a20b22cee3ad6b6904d2d6dfa5bd493a6d342895dae6e1a81d1c66e972532e432e2a3a2
SSDEEP 98304:QmSWOiIyUdDV4js7zyCjZ6rCOVLUjH5oxFbxG:QXDm47LluVUjZEdG
TLSH
T1D8F522017B00B4F3C2416AF4B48697D7D2203DBB7B5599C76EC4134E8CEA6D9AB17B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3820	6D6B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D6B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3820	4320	2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Users\Admin\AppData\Local\Temp\6D6B.tmp
  "C:\Users\Admin\AppData\Local\Temp\6D6B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_0ecc4a982fdaf310434c4dfaebf1c884_amadey_elex_smoke-loader.exe 6C0EB8D13EB416BD5A35D49C562EA0BE36FCCF05183432886BF037DA6C44B07D579A72474DDEFFE2A8E374FD5F4E3DED54FAD362223BEF0C9CECEC9FEB6A132B
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6D6B.tmp

Path C:\Users\Admin\AppData\Local\Temp\6D6B.tmp
Size 3.3MB
SHA256 6527be2993a4490a28cad0866a7f274ce3a63aac0b5ad15e71056595b7e932de
MD5 d9bd841c479322d470e78e8e757d7a51
SHA1 4773da2b1b633a80cc63dffa9defaec7bbb388fa
SHA512 d2a27595e842645d17183efb3da1cdf572ef6c739765f6011f12059e286c27f1742bb4fbd5cc34aceda8fc2a3015a1a4aa12cb4421af280ef5830e95cd618834
SSDEEP 98304:QmSWOiIyUG2i9d0aNPGZCbVLUjH5oxFbxG:QXTaNPGEbVUjZEdG
TLSH
T19DF522017B10B4F3C2116BF478868BD792307DAB7B5599CB2EC4134E4CDA6D8AB57B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download