a8188152b639b3be182420f01d57babde99ae5d18c2ae969fe1fa0f322fe19f5

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260729-gexppsxydx
SHA256 a8188152b639b3be182420f01d57babde99ae5d18c2ae969fe1fa0f322fe19f5
MD5 4e312ad3974babc33a0e7d5adfe17551
SHA1 0a2ac2eb28edfd0e47522d5b2d32ba002c0316a8
SHA512 c11ac6b7a944ae306d372ded9caa37d5c33bfec72f960118c2c01135ef383935ebaa8f45fb54f91e9f041ac5b4ad144bf2858e602a49836f759b8e959d6eec11
SSDEEP 49152:yoa1taC070ULiHsiKyP/ibRx+lq4i1RncPXWBicdvOJFIg:yoa1taC00bl6+lqf1uPXW8Z
TLSH
T15AB50206B714B0F3CA515BB0A956DB93A2217C7B7B009DC72DC4535F0CAA6C8AF52F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1640	79DE.tmp

Executes dropped EXE 1 IoCs

pid	Process
1640	79DE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79DE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1640	4372	2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\79DE.tmp
  "C:\Users\Admin\AppData\Local\Temp\79DE.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_4e312ad3974babc33a0e7d5adfe17551_amadey_elex_smoke-loader.exe 082945F5263903D9170230818A20CD9B337EC0C80909EEC2628CC0A341191A56169289F2A0DB0FBFF38A9DF06D6735196A64A5E23400CF1320249ABE5FCF06E2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

79DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\79DE.tmp
Size 2.2MB
SHA256 6321f01d4340d43178ab707d630f922ae10e09e74a3637ad74fe503d99af3c42
MD5 a479c54580349a1e788001e4383503ba
SHA1 e2625e4feb1810b3e5dc1ce31b8e932fca488de4
SHA512 87478fb6d977fdfc73d282147ed5fd0976980e00dfd5496c089abf6393738d2de6dfe8abae0e2e6d23949d1e33aea1f8d9c3342feb76e51d4967d0a17d2a0325
SSDEEP 49152:yoa1taC070UkkAnhSdKX8oLaztibGRwlUcdvOJFIg:yoa1taC0CkihSdbpzpRZ
TLSH
T13EB50105B718B0F3C6225B70A955C793A6216CBB7B419DC76AC4534E0CDBAC8AF13F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download