a3de882bf20cd6333af1fbe739c4ebeb8e1e97d1976755dd590386f853258d54

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_de00151c982f94df92687d66d9cdfd58_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260727-jpd2fsysft
SHA256 a3de882bf20cd6333af1fbe739c4ebeb8e1e97d1976755dd590386f853258d54
MD5 de00151c982f94df92687d66d9cdfd58
SHA1 fe4fe9e55aaa2cec85c53ac81a3352ec72569c16
SHA512 3322c6dac50a3d7723945535ed987deefc807b12225cc4deb5f47a60a496225afe2d77438386cbb9b3b6c5773387eedb6be3bf5ab0b29359cb3abda90759da52
SSDEEP 49152:Qoa1taC070dN3f1dWiVNq4W29PyIZsthvq:Qoa1taC0M3LtW29Xmvq
TLSH
T163952320F7D5C2F1D0850A70B6A2C7D698693DBD56528C837BCC2B2F6850EC0AB75B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2736	9D93.tmp

Executes dropped EXE 1 IoCs

pid	Process
2736	9D93.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_de00151c982f94df92687d66d9cdfd58_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9D93.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 2736	4400	2026-07-27_de00151c982f94df92687d66d9cdfd58_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-27_de00151c982f94df92687d66d9cdfd58_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_de00151c982f94df92687d66d9cdfd58_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\9D93.tmp
  "C:\Users\Admin\AppData\Local\Temp\9D93.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_de00151c982f94df92687d66d9cdfd58_amadey_elex_smoke-loader.exe 809B859D3518C076CB49EA66718726D205E717D5DFB143A43D1E4A89ECF0C21C6C7528DB3B2C7AEFF64C2FD9722D08EBD878F90155F0DE158F05FA97F62584CD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9D93.tmp

Path C:\Users\Admin\AppData\Local\Temp\9D93.tmp
Size 1.9MB
SHA256 3c4d7d96a98d37aff121d090766e8fc38b2e8307470633133c863a8709ac1e2f
MD5 d55b71c7a3d4a16d120808e46cf7edb5
SHA1 1726f14975da70d3c5ade433b8265f872f4dbedc
SHA512 dbbbf330923430704d93c99270ae1d28bc459e74ca8551fe740f3f85f7e819f423fbcf7bc5da400ac7acceb35173a2b02a9c5ed8faa412e5bf01b2547468a14d
SSDEEP 49152:Qoa1taC070d4HZ1WySJ4AKMCsbNvod48Dj+uc:Qoa1taC0lOZ4ZobNvodtja
TLSH
T1EE952241E7C5C2B2D4811672BA51C3D2E8793EB997518C87BBCC0F7E1DA0EC46A65B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2736-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4400-0-0x0000000000400000-0x00000000005E6000-memory.dmp