de06b7c1b65038fcb330eccfe09ed59aaf595a76a252128e0d9c702417ec2c0c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260729-mg91psej7v
SHA256 de06b7c1b65038fcb330eccfe09ed59aaf595a76a252128e0d9c702417ec2c0c
MD5 e245ab16c0a56bc0f89dc635a797f408
SHA1 25976984fbd510d7bb86d34703f9607735f758a0
SHA512 537355629de07b2cd247941c6960876b4fed11cf4dbd5abb04b67c4f2c1e9e77c92f44d659af224ffbdc42acd7b3c708d674dffb06e7939ff2af2dbd8195bd35
SSDEEP 49152:+oa1taC070UzxVVuPnnAbhwnOhMyY6woYnj:+oa1taC01xVwAlhJYvoYnj
TLSH
T1B3952310F395C276D0C206B2A2A1C7A3E8653D7857054D87BBD90B7F19B0FC4AA72B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4680	F17F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4680	F17F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F17F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 4680	1504	2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\F17F.tmp
  "C:\Users\Admin\AppData\Local\Temp\F17F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_e245ab16c0a56bc0f89dc635a797f408_amadey_elex_smoke-loader.exe 70D6D3663E0B849AFE37D9DC188F234AC27ECDF79E84FB0012F3BE4D49F6FC1083CEF7B19A947B1D85C581206D6820E35C989433813436C72E10B4D173904B64
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F17F.tmp

Path C:\Users\Admin\AppData\Local\Temp\F17F.tmp
Size 1.9MB
SHA256 03b3cbe293f587aaae3de698bc74ee3da216ad7861f54497049bf124bc785b8d
MD5 08c3c6c938ea0ee6f2ed762f0a07e079
SHA1 398c287b08f68c98c06a77d0caecb3f5259979ae
SHA512 b8d60548d25c315f54310d4e3282453e60a486210853737f1deccb1cd310fe8df54cd10e3595b4252b89a1a49824c5a900f2b5d0f56e75effd712cfe1138fe14
SSDEEP 49152:+oa1taC070USXXHSFXFOIev+YpWU56yOBF1:+oa1taC0EX3SFmm1zyOBF1
TLSH
T1C7952264F791C2B1D0C50571B692C7E398793DBC96858D837BCC1A3F29A4FC0AA26B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4680-5-0x0000000000400000-0x00000000005EB000-memory.dmp