6a30a5cffe7abb6a2093d9f12ddddfdea54055ec2158b5d9e3b592bb8d978843

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260801-2fcfdayxev
SHA256 6a30a5cffe7abb6a2093d9f12ddddfdea54055ec2158b5d9e3b592bb8d978843
MD5 02f00064c94bb9e9f2d90b76f52b0e7f
SHA1 6fb0d782aa26f5a5fc2680a6a545a668d2eef167
SHA512 50ed7251085f441494406df38404d6630a563091cb2e7fa3ca905a718f902b75b5decfa972d9aedefcec243a898c28a0ed444f163bcae203a36a365abb91c81f
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10d4AQtYNrHDIdYxyCrornfVVTx2pYxdYKtvUE:Qoa1taC070dtQtCrU2xyCcTdVEjKtF
TLSH
T109952254F3C5C2B2C0C20A75E69283F69C793E7896459C437BC91B2F2EA4FC46A36617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4368	579.tmp

Executes dropped EXE 1 IoCs

pid	Process
4368	579.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	579.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4368	2956	2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\579.tmp
  "C:\Users\Admin\AppData\Local\Temp\579.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_02f00064c94bb9e9f2d90b76f52b0e7f_amadey_elex_smoke-loader.exe A631165496DF9B998E272F7F5623CC5CE1FABE3E1E922A544930CBA83CFB80F51871023FBFA87D8A14F5D8408E638A1CFAB01FA19E2B0D921F91D046BCFC4116
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

579.tmp

Path C:\Users\Admin\AppData\Local\Temp\579.tmp
Size 1.9MB
SHA256 5778b106dd076916713fbc75d8a0d68e36038318bce8b8df6b2c89490d8c4999
MD5 1e7f28560228e7c4a864468d19c4e7a8
SHA1 76aa966868213f782038abccc9034d056a070ba8
SHA512 688db51af3ee7adbb946ff8570058747d0fede5a2c896d8a0365a557cc1336e3eb7da398e4f941fd02f54ea649e2e0e562196a7f8f85e361bf43777030b7fd76
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dvh7bVTyxtAL8FG82+xlej7lkJ5RNtTBxwFiM:Qoa1taC070dvfcALX1+0uRNtTBADn
TLSH
T12A952314F7D4C2B2C0C10A71E542C7E2D8653E7C5A429DC3BBD91A7F2AA4EC06A72B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2956-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4368-5-0x0000000000400000-0x00000000005E6000-memory.dmp