d71d5c93cd3d85658c011db0968e3d345b1376798872f9a10344dfe91a008649

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260731-xc88qaem41
SHA256 d71d5c93cd3d85658c011db0968e3d345b1376798872f9a10344dfe91a008649
MD5 360ee5dbd0b78a232d578db9d3edf25f
SHA1 40a8c6b8774ff756273dd7258501a16e6639b495
SHA512 b65316080db66f7b749bd1eb6b20e72019c04b2b1c2cf72e40a4422512952a22f71fc3d35d03e4e7a5694543b8a07bc2ce4a17119c17a9c6f68d97f3915c4530
SSDEEP 98304:emhd1Urye0ZQQ2972iLXHNpxFnjV7wQqZUha5jtSn:el39t3xlj2QbaZte
TLSH
T14F26D00996FCDA2CCC1F51F4A1A51145C7F0A564EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2416	3B2F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2416	3B2F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B2F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 2416	4736	2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\3B2F.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B2F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-31_360ee5dbd0b78a232d578db9d3edf25f_amadey_elex_smoke-loader.exe CD0D16E93D866BA055C1DA42B111CBE96120B34DC9DC446FAAC701E685A096C5523B597CAE81AD9C062E8B189F726F473702DF2DE51A83097327D76E0116ED9B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3B2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B2F.tmp
Size 4.4MB
SHA256 48b94f7a0c590fad574d0e01c62a5ed0cc1232b43b5e94ab9af0c91db1eb6586
MD5 e25b1fdb26e2ebe713f4c38e86b4b79c
SHA1 34b27ca9b5ff4003bffe56de4c1d8bdff29432d7
SHA512 166eff4daafd46a64f88c0ec27417e8ee8c9fe7c05b1ecc0ca99dabdce59c89a5fc57a84982324450d5e149aa62afcaddebd628736503c151a20a5081074aab1
SSDEEP 98304:emhd1UryeX+d4COPABzghVV7wQqZUha5jtSn:el3fCOY9gv2QbaZte
TLSH
T17226D00996FCDA2CCC1F52F4A1611145C7F4A564EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4736-0-0x0000000000400000-0x0000000000849000-memory.dmp