4f34328acc6f11d01beb34f9b16d65c5f378c0deaa88dc1c5f5d5310aa851524

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260728-xmervsbc89
SHA256 4f34328acc6f11d01beb34f9b16d65c5f378c0deaa88dc1c5f5d5310aa851524
MD5 35ab8d2f377ecc1f03d0d306899457fd
SHA1 8b27bc864ab690b0edd7bdbaa3fed892e1cd01ef
SHA512 586bf1531fae7c6c2c1f9526ca3dd9d8bd256ad932c4328b6e86e5692decd0c5bb18698efb3aac6f725c44047dc5966f85d6bae96fabc3fa61035e784ad1b98a
SSDEEP 98304:emhd1UryesNqrctD7py0NVLUjH5oxFbxCVLUjH5oxFbx:elMNqrAFNVUjZEdCVUjZEd
TLSH
T1B9262350BBD5C361E18274F964D343DACA343F3C4676998B2FCA1A1EEC698E37275242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3308	194F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	194F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3308	3144	2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\194F.tmp
  "C:\Users\Admin\AppData\Local\Temp\194F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_35ab8d2f377ecc1f03d0d306899457fd_amadey_elex_smoke-loader.exe 98B85DAB5C63501C819FA949F6DEAF10BC1C820C2A2494692A7D54E258EC32320162E56C5AF6A68B0806A2263B1B827BF914147AD2EBDADD9DBDACC0BEC91DC9
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

194F.tmp

Path C:\Users\Admin\AppData\Local\Temp\194F.tmp
Size 4.3MB
SHA256 3b86702d4620911724850690ad05d3ec1b92f7a8d1cac5a8efc40e4337c205c5
MD5 fde84ad9610a087c0b5e7ab3fd25ba6c
SHA1 6f55df5d17a107c42af672c516ead51d2a07d492
SHA512 193382078afcccdc826870f63d51dc1143b2d69d2bd39ed0a573c176ce24025fd68b5208e1ef82d9f723abdc52fde8970cff19373fb48fe75f7822b2d1ca29c6
SSDEEP 98304:emhd1UryecT1M7wFrkTVLUjH5oxFbxCVLUjH5oxFbx:elgwwBSVUjZEdCVUjZEd
TLSH
T1DF262381B795C7A2D0C274F8608343DADA343F7D157A958B6FCE1A2EECB89D27274142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3144-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3308-5-0x0000000000400000-0x0000000000849000-memory.dmp