72d63aa8c6cc44aaf29d01edb59ef6073fd44e8b5ccdbcde5ed66193b87d75f7

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-1mnasahl21
SHA256 72d63aa8c6cc44aaf29d01edb59ef6073fd44e8b5ccdbcde5ed66193b87d75f7
MD5 38be9c50f597e082ecffe33d94060cf6
SHA1 da11ee99787e935963e7af3167797c0e14c7dff2
SHA512 f35a7f91bf17e9b3b1ec7719fd6e8a6d5781129248fa56b218a906aeec4181e8c4a395b8beaee9bba378370b9df8f944ad0f928c2c60dfbbf8e5f9228d04bf83
SSDEEP 49152:Qoa1tLC070rZuACczHbmusF29r5Krl05UWLSfY:Qoa1tLC0f4/Gsvu
TLSH
T19E952280F790C1F1D0861A74F552C3E698B93EBD56018D53ABC91B3F2EA4EC46A78B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3316	5B0C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3316	5B0C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5B0C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 3316	2844	2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\5B0C.tmp
  "C:\Users\Admin\AppData\Local\Temp\5B0C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_38be9c50f597e082ecffe33d94060cf6_amadey_elex_smoke-loader.exe 0F0D8F0B924386B555E0D45BB9D8FE7762AB849FF9E620CAB11505F0BE47230AA089788D1F9CCA3FAD4762A8A4C68D80392BB6FE37EA02758E7A7A4A95022622
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5B0C.tmp

Path C:\Users\Admin\AppData\Local\Temp\5B0C.tmp
Size 1.9MB
SHA256 8c7fffd8c8a11c4eca7f461593f20d0642b0695f2f8c2d03a60283f4639027a8
MD5 5f585ad0319d47e6f7715f84fc387201
SHA1 a1152cc2d117c54e473a62cd0d9d409b87b80994
SHA512 7c2fb7d3fef7bd55351bfb159bd66fe396e2be076761c47e4744aa5114c97906af82105f39fc64585ff82f20af2c0a9b9ba86dc0d73e1f954bc086cfa6cd12fd
SSDEEP 49152:Qoa1tLC070rPFiB5xAK8aOwFLo0+V8+PyY:Qoa1tLC00mOwFLor
TLSH
T1D6952244F394C2B6C0C20A71A692C3D798653E7C47068E877BCD1B3F6DA4EC49A26B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2844-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3316-5-0x0000000000400000-0x00000000005E6000-memory.dmp