647a325e93c79b33a5783d3b5de93e763476ae835e7a696c1ac9ceb831774361

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_2552d6953e94e7085da24edfa62b22ef_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260731-jkky7scn21
SHA256 647a325e93c79b33a5783d3b5de93e763476ae835e7a696c1ac9ceb831774361
MD5 2552d6953e94e7085da24edfa62b22ef
SHA1 b246ab1afcb537b98a0b4f12acfe710b79ca94dc
SHA512 56e6b28c04b73066acce5ed931b06cb437df619dc65fd94de37c637d6b32cfc0fe46de34d12334de56f629ad3de63369c7f17c1a46411c5cf59bea7440bb0e44
SSDEEP 49152:Svm2AC0d1XqrdryeJVikgvmOxm5TEH/LJfD9ytj/c3EHSwLVT5dVXeQqZUhh4r5r:emhd1UryeWPfNfer/pV7wQqZUha5jtV
TLSH
T1F826CF0896FCD92DD82F52F4A1641185C7F4A524E7D3AF997DA2F1F03A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2168	9093.tmp

Executes dropped EXE 1 IoCs

pid	Process
2168	9093.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_2552d6953e94e7085da24edfa62b22ef_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9093.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2168	1584	2026-07-31_2552d6953e94e7085da24edfa62b22ef_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-31_2552d6953e94e7085da24edfa62b22ef_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2552d6953e94e7085da24edfa62b22ef_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\9093.tmp
  "C:\Users\Admin\AppData\Local\Temp\9093.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_2552d6953e94e7085da24edfa62b22ef_amadey_elex_smoke-loader.exe 9888A84646806AFE7C8B2A7800F9C5F23E79C6B8CEF3DD88E0A04ADC8FB646208EA3639889D4F079CBABE61D698BF78D4EB5D512D139E619703933E1731E405D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9093.tmp

Path C:\Users\Admin\AppData\Local\Temp\9093.tmp
Size 4.3MB
SHA256 72283b3ad6551e4473542381f78ab77a893bc06302ba12d4955ee716bfd787df
MD5 a808ff08b5e29fbe11bcc8450e05f73b
SHA1 86c3dfaf2aaba256d31a8aa391c0a57f36d5d8af
SHA512 dc8aa6f1f5386bad830c50349a486141cc9879acf71639ab06ea6cb3e1c7c09372feec3bea72657d7c5647020691fba0f3cc390767b2d7ff0a5febfe643015fb
SSDEEP 49152:Svm2AC0d1XqrdryeJV4kiX4FDjrD8p0X1j8wLVT5dVXeQqZUhh4r5VC9PI+Kt/N:emhd1Uryen/l3BV7wQqZUha5jtV
TLSH
T1AE26CF0896FCD92DC82F52F4A1641185C7F4A564EBD3AF997DA2F1F039823A4B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1584-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2168-5-0x0000000000400000-0x0000000000849000-memory.dmp