aeb18f83252ee6fb483f4e4c30899031786625bdc034d2292b99b86a08bf0410

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_f66db38e9c7e89664716606e4c0a56ca_amadey_elex_smoke-loader.exe
Size 3.6MB
Sample260722-srdm5stybw
SHA256 aeb18f83252ee6fb483f4e4c30899031786625bdc034d2292b99b86a08bf0410
MD5 f66db38e9c7e89664716606e4c0a56ca
SHA1 1b9d1c242d5743298a9cc39e59f4b1f4340dc4cb
SHA512 d1683a8806fdf12c06891b13a3d130330dcca88a567886d3bfa208c83920773bf58c50178a73f827dba94a84a40237aac5129585c52e184e06395daf6be762a3
SSDEEP 98304:/mSWOiIyU3FLzHaEUw55NVLUjH5oxFbx:/X5F/6I55NVUjZEd
TLSH
T104060143FB8186E8C28D457A6F554281922EFA216A0F53527A8C130DCF537CB9F66E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2384	62FB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_f66db38e9c7e89664716606e4c0a56ca_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62FB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2384	756	2026-07-22_f66db38e9c7e89664716606e4c0a56ca_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-22_f66db38e9c7e89664716606e4c0a56ca_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_f66db38e9c7e89664716606e4c0a56ca_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\62FB.tmp
  "C:\Users\Admin\AppData\Local\Temp\62FB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-22_f66db38e9c7e89664716606e4c0a56ca_amadey_elex_smoke-loader.exe CCD9B9726561CAD345667DF56C9D1127055889EA4E3AD57D5A9A4257B05A11C51A392414C1F21804C186495740F947654A99FE9DC163E99317F6FBAF365BAA18
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

62FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\62FB.tmp
Size 3.6MB
SHA256 5a79d99e0bdfb6b4a22456385c43e36ca0e800af973967c21ee93d5bf209f26d
MD5 fee96802be0ef04eed8da3c94d7264bb
SHA1 2e55d2be2b696416897409ec81be972f1552d260
SHA512 4513288137fb7d36955af87c1890b3c8f30fe45eb63378b6315e7c1208401ecae79dff65754bf51a0a973310751a529d3ef4ac2d59bcf0fa5b81959747b0e5af
SSDEEP 98304:/mSWOiIyUw6cP1F8i4iDw6VLUjH5oxFbx:/Xy6cP1KriDw6VUjZEd
TLSH
T1D4060143F7918AE9C28D44BA6F504285962EF9216A0F5742798C130DCF937CB9F26E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download