d39d7f18d4fcbb0eae374093e1eb16416f7c31ea641e69f030155ed2e3137099

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260729-ylqcmseq91
SHA256 d39d7f18d4fcbb0eae374093e1eb16416f7c31ea641e69f030155ed2e3137099
MD5 a7663bf0dc195f159a54c3f1c662b87e
SHA1 f213614683bac668094b326cd58b894a35d68cbc
SHA512 af465e3ecf36a3f4f3a60fb877edef37ecfac36926b6cb14fa10c8f9c965a6ceeac7e35d5a0ab3523d4ba29dd9327e1be52bd0ab626324a11772b50e0d5c38f5
SSDEEP 98304:Cmhd1UryeyLwVizHonD4POm7/e5VLUjH5oxFbxhVLUjH5oxFbx:ClqwEzonUPOmKVUjZEdhVUjZEd
TLSH
T1E1262381FBD5C272E09311FA648343D6D8343F6D51A599473FCE2A2EAC989E5B378243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4264	A0D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4264	A0D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A0D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4264	4392	2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\A0D.tmp
  "C:\Users\Admin\AppData\Local\Temp\A0D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_a7663bf0dc195f159a54c3f1c662b87e_amadey_elex_smoke-loader.exe CEFA136954DF829FC41821E5166B5CFAF2906DDAC936D27F9042F73ACF05D3264046A5B440DB02B1DA04999EC0DEE7875B4408D76E4D35DD0209A39AC3A71AFB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\A0D.tmp
Size 4.2MB
SHA256 2058cf9413757e95105702f2517afb0f437adc98e9dacc69c2543c92e058a6f1
MD5 6b5f0f2f29155feb54e60696c031e505
SHA1 cbb8000d8748a0c99a0e6f7bf03c38e2c2d6f409
SHA512 769aaf8929e5118789c73203925da3e624ede46a29e534cfebade5f6e334697c91d4939763be28a4089e209a9b3ccd20aed5496ef1fdd7c33028d48e1da36072
SSDEEP 98304:Cmhd1UryeLyOdQ6OeZhrLGVLUjH5oxFbxhVLUjH5oxFbx:ClvdQiHGVUjZEdhVUjZEd
TLSH
T18A263381BBD0C272D18265FA64C343E6E5343F7D51659A472FCE1B2EACA85E433E9243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4392-0-0x0000000000400000-0x0000000000849000-memory.dmp