40f1df1283b9149f1670e8f93771f4b0a88a83fc0b442757718b5d2fedb83412

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260721-22kzmsgb82
SHA256 40f1df1283b9149f1670e8f93771f4b0a88a83fc0b442757718b5d2fedb83412
MD5 8bc783d5b76f145c445c0a5124aca4e1
SHA1 b717c2245188b16e21291ea83be7524327dff00c
SHA512 d00bad31fb3b56289b62a2c4adceb7239c042f5f5cc0f2c3fd2f057bf989f1e71e933e0facffef59343696ba8cad82664a424339c31b7a056606b8805cfb3a9e
SSDEEP 49152:boa1taC070UGTLoG0Cxh+ATR18f2TTHH:boa1taC06LBh+wRufqD
TLSH
T10D951251FBC6C2B2C4825971A552C3E2DC6A3E7C27429C83BFD81A7F1960FC46A65B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2356	603C.tmp

Executes dropped EXE 1 IoCs

pid	Process
2356	603C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	603C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2356	1920	2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\603C.tmp
  "C:\Users\Admin\AppData\Local\Temp\603C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-21_8bc783d5b76f145c445c0a5124aca4e1_amadey_elex_smoke-loader.exe 9156BADBAD93DBD6CAF5BCA0BE60BC3B88BC2FA8B689072D7020741E0E3247CCE1BBEAE4393DCB33265090DE636B13A07B868807FB4BE8DD462F60C62C9759B9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

603C.tmp

Path C:\Users\Admin\AppData\Local\Temp\603C.tmp
Size 1.9MB
SHA256 82aaae30d433a44c88a03de9277e5a61a3e8d44f84094c84ca4e80364685de19
MD5 d217a3b489676fa43ba12b7981064d82
SHA1 e395498ef22ffd56e3b23ffbc38b03772ed6aa28
SHA512 16ac160d8e96eac7749796aab72112f40131deefce1e085eb24c6734312a12d41f9b93ceec80aa4da9d1c4488c6660fb70e80905cb7b0b5e7a757df4a3109302
SSDEEP 49152:boa1taC070UTnT2LgEz8g7D3EbfbckMAP:boa1taC0xSrz6bfQI
TLSH
T187952261F7D0C2F6C0821970A592C6E2DC6A3E7D8B428D87BBD91B7F2950EC06A71747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1920-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/2356-5-0x0000000000400000-0x00000000005EB000-memory.dmp