2f712a5aab14b39046b2066ac4e4c30056daff0bcc74b9d1156a8f8283348ab4

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_60378c9ec01c447b3fe418d7b59936d2_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-ayjtmazzcs
SHA256 2f712a5aab14b39046b2066ac4e4c30056daff0bcc74b9d1156a8f8283348ab4
MD5 60378c9ec01c447b3fe418d7b59936d2
SHA1 a7502a6b8b1aaf46f6e2105c6511eac409090b0f
SHA512 6fcc2c8b0d6d3de17741e8a12413c4f3eac89451f869f9310d39204a2809747d508826b1c229aba216b7312ef502fc578b6b7069cab8f0ca0898d70c68c33755
SSDEEP 49152:boa1taC070UXByZDpfj2UdRIiRCkRCq0vpobSTTQG:boa1taC0ZA1cWC6Cq0vvwG
TLSH
T1B3952351F7E0C2B1D0910971A1A2C3A7E8993E7DA7418D43BFD8173F19A0EC4A636B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4008	21E.tmp

Executes dropped EXE 1 IoCs

pid	Process
4008	21E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_60378c9ec01c447b3fe418d7b59936d2_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 4008	3324	2026-08-01_60378c9ec01c447b3fe418d7b59936d2_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-01_60378c9ec01c447b3fe418d7b59936d2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_60378c9ec01c447b3fe418d7b59936d2_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\21E.tmp
  "C:\Users\Admin\AppData\Local\Temp\21E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-01_60378c9ec01c447b3fe418d7b59936d2_amadey_elex_smoke-loader.exe 67AD54008553615C696DEA9612DD6BAC25AA0A8D336FF5A0A654C0F13E6AC16838A441D7B7F10EA7A43651451F481C7BA4A969FA95613C0A59C9F747C7360E59
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21E.tmp

Path C:\Users\Admin\AppData\Local\Temp\21E.tmp
Size 1.9MB
SHA256 f0835562b439d026329895b8443e4813b7825f3965a98aa0875d6ffd98fce7db
MD5 ecaf5058857e3974da495ead6fafbb21
SHA1 675225ccecac366ed290fcd50431fc0c0ac89488
SHA512 1827ed8526fe5ed084232456f74f866dec623e4aa65a71b3c723b9c98f42e8dd353ddd8254f3be940abdee7fae8544405bf7b0e7e0ced64b0cce71bc684346d6
SSDEEP 49152:boa1taC070U1MzotHlLnLE2WTzPKIYQtuXuTigKY8:boa1taC0PMzonAPKIeuTiV
TLSH
T1EA952211FBA6C2F5D0810672A592C6E398693E7D47568C836BC81F3F2D64EC0AB32357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3324-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4008-5-0x0000000000400000-0x00000000005EB000-memory.dmp