3830ebaffb40906aa3532a251fe35c273eb1ea2225072e530f99c2baa1068e04

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260731-gdccdavemd
SHA256 3830ebaffb40906aa3532a251fe35c273eb1ea2225072e530f99c2baa1068e04
MD5 860ed36914a14af7843daba56a60edfd
SHA1 5975196c1698930063d5b8d7287eada88f283c29
SHA512 295f0d3abe68368804904617a50632dda1fdc92b90f67f54214c4a63536ba826b802f690806212166b3b60fbe483a93e43a6190bafbd8590243c254ac0dea5fb
SSDEEP 49152:boa1taC070UZmvwzmH7GKu/f7yVhjx2fDy3856:boa1taC0yISH7GK98fO388
TLSH
T152952315FBC9C1F2C84205B1A552C3F2E8783D7896418E83BBDD1A6F39A0EC46675B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2644	43AB.tmp

Executes dropped EXE 1 IoCs

pid	Process
2644	43AB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43AB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2644	1948	2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\43AB.tmp
  "C:\Users\Admin\AppData\Local\Temp\43AB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_860ed36914a14af7843daba56a60edfd_amadey_elex_smoke-loader.exe 04C263A6176F2FD6D24DD79D51DB6BC7C73DE3E8279C0B1A8719F764B6EA57259D04C81AFAEE2956A71F425222B08D5F027BCF17F29AEF76E1A73B61426BBE0F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\43AB.tmp
Size 1.9MB
SHA256 b2b2353619eb35f1361e4adcd8e7d3cdba3843b6bb380765888437a9c499974e
MD5 533de68f8229d142bf9905b151f536cf
SHA1 1cc6a17e73de8d87031229da099060849f73d95e
SHA512 5d469ddddd1ebac4ad8c023795530f1c4d2e8beb6fb3a70bfe0117db8262f1693896da4b01142ff01657ef67f3f8d12e53c1b28d1268975bbdb153c6c5683221
SSDEEP 49152:boa1taC070U2dhatCOhB97DaJzke8PK9:boa1taC0yatCOFDa5
TLSH
T1AA952360F791C2B5C0810631A592C7A6DC293E79974A9EC7BFCC1F3F2990EC06A66717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/2644-5-0x0000000000400000-0x00000000005EB000-memory.dmp