2dab502e08d344a40dff834b3951b777ede5cbdb4c8ed1b08971a003d739ec4a

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260801-tyv2fade64
SHA256 2dab502e08d344a40dff834b3951b777ede5cbdb4c8ed1b08971a003d739ec4a
MD5 8583890b4941487234b1b81bf0eb8645
SHA1 222f16a6e319c163d0768b7785050c6e2e84377f
SHA512 c59c29bf970d97ea9ab84566352754d8e188c03b1fa671941c2ff8ce1ee4ef94b2af67622c9e2091ae737e38bec0f1e8d38efe75bf0a0d8929e02c5efa926af0
SSDEEP 98304:emhd1Urye7KKs2bZpt/hD7YaEwD11VLUjH5oxFbxCVLUjH5oxFbx:elbP3nlhD0aEU1VUjZEdCVUjZEd
TLSH
T1E6262341F7D4C361D0C275F9508383EADA343F6D566A964B1FCE2A2EEC788E176B9102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1196	6193.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6193.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1196	880	2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880
- C:\Users\Admin\AppData\Local\Temp\6193.tmp
  "C:\Users\Admin\AppData\Local\Temp\6193.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_8583890b4941487234b1b81bf0eb8645_amadey_elex_smoke-loader.exe DFC043B63B3FCDD03E76B3B4E594C0CB489C173535DA8017DEE07B17B12C9EE393B9DB0277BFB81C16C36E38C3D70B289C8A9BC3967B827344D1D664EA668C7C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6193.tmp

Path C:\Users\Admin\AppData\Local\Temp\6193.tmp
Size 4.2MB
SHA256 9fcff1b42e7ba0113915b81f1ebb3d8aa55b49bbf53036acae00c0e08d984358
MD5 9238376e7817c41e7827fea3d8f65921
SHA1 281133e1f2565964a24c83dcbed96056006ce78f
SHA512 ab26a4aca85080e21741406f22486e5c7210b9d09798f51e6445e35d0d9e49bedb0325296306b676b4a6441e044e15554e2f287934ba103ac1dbd944c75ccf4b
SSDEEP 98304:emhd1UryeUgcIBD9SM7UvRVLUjH5oxFbxCVLUjH5oxFbx:eljlBD+5VUjZEdCVUjZEd
TLSH
T198262381F7E4C3A1C1C275F9608383DADA343F6D5575998F6FCA2A2EDC684E17278242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/1196-5-0x0000000000400000-0x0000000000849000-memory.dmp