164c2f73cdc2556a2fe0c8f88f989b3cdfb2cec8c0c70cbf7f32e6af220c0dc4

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe
Size 3.3MB
Sample260722-hfpadsen21
SHA256 164c2f73cdc2556a2fe0c8f88f989b3cdfb2cec8c0c70cbf7f32e6af220c0dc4
MD5 4a3ace79086507667ac0ebf93fa9a093
SHA1 77eb8f9edc845945edfa3a59610ec0988ff24989
SHA512 28764c7436ed6013a489551c4368edc62bf502c7f25434bc31bce7bbdf135d9fbbb8bf0c4f352cd5a87f4128e7298850fe77d4a6e1a0d51ff56346cd1ebc97f3
SSDEEP 98304:QmSWOiIyUFCZUUFUUTRGLdVLUjH5oxFbxG:QX/CdFUUeVUjZEdG
TLSH
T1C1F52301B710B0F3D2416BF4749687D796703DBB7B1099C72EC8134E8CAA6D9AB67B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
556	3EC9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3EC9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 556	2652	2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\3EC9.tmp
  "C:\Users\Admin\AppData\Local\Temp\3EC9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-22_4a3ace79086507667ac0ebf93fa9a093_amadey_elex_smoke-loader.exe 7AD77AE145A9FBC07AFF733BC04516F18C2F08684C092C2C4C5C7CB14B54A5E8873BC1CFFAA13662080A5A7D43B08FB95EAD731703B48FB8933962A02E8462E3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3EC9.tmp

Path C:\Users\Admin\AppData\Local\Temp\3EC9.tmp
Size 3.3MB
SHA256 8f9dedad60ca5468efa3a6a7dacac9381fb9b8cfda8c9367feded73d0dc9e2a8
MD5 49e285abeba15ead35e349317880dabc
SHA1 3eb3ca1768403776cf6eecacddef00d188f28a33
SHA512 df97fc3acbf7fcc72bda7ec8bceb17d981cfe2fff1f30ff7fbc7663ed704c89ba2611098cca0cff52c950f548ac44929b6cfe69be020c02eac54276ec9943723
SSDEEP 98304:QmSWOiIyUX9PwrNuAh/BFLPVLUjH5oxFbxG:QXFNuHPVUjZEdG
TLSH
T1ABF523017B1074F3C241ABF4749697D796703CBB7B1499C71E84239E8CEA6D8AB27B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download