910ecc2566f0e885e40b5efdf93942b541b9911a8a6fd19eea63bb330781b2df

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_2d694d0ab4ebb2e8aba9e1b1911abb11_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260802-g2fppsek7y
SHA256 910ecc2566f0e885e40b5efdf93942b541b9911a8a6fd19eea63bb330781b2df
MD5 2d694d0ab4ebb2e8aba9e1b1911abb11
SHA1 2abda7619e9cf981968dc126fec16dda11d568a2
SHA512 c8034b1122efef04d9394d617dcddd8d1d038e2ce84a42734c6e3ce914e8edb3375ac1e29f04b8738541c3d9db1ac33824148865c111bc5fc5d46437aaf3fc17
SSDEEP 98304:+mhd1UryeQcbuAjPultfa0jE+9NmSVLUjH5oxFb:+l1buAjPwtC0jE+9jVUjZE
TLSH
T14A262340B795C262C08575F6B9C383CB99343F7C4625A98B2FCD1A2EECA89F57279143
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2876	3ED9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2876	3ED9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_2d694d0ab4ebb2e8aba9e1b1911abb11_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ED9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2876	2980	2026-08-02_2d694d0ab4ebb2e8aba9e1b1911abb11_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-02_2d694d0ab4ebb2e8aba9e1b1911abb11_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2d694d0ab4ebb2e8aba9e1b1911abb11_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\3ED9.tmp
  "C:\Users\Admin\AppData\Local\Temp\3ED9.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_2d694d0ab4ebb2e8aba9e1b1911abb11_amadey_elex_smoke-loader.exe 352DDF2BA0A095696C7ABD072B0B4CB80209A06DE23D1E27E67FB469D50A6C403E169EE6B8F912EEC24DE14A2E83E71C3978B58D865DC6B0C2B08B4FF15B4932
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3ED9.tmp

Path C:\Users\Admin\AppData\Local\Temp\3ED9.tmp
Size 4.2MB
SHA256 2598ede0f99e9eb77db8415223b50c09c8101677cf584be8df874004d14ad198
MD5 1b74a016a3c82879cb8457c83246dbdf
SHA1 d82c048d7b979ece646d29ebf0588a975501da63
SHA512 80fcdeb246cd1dacc44bda393d4eb0561fe3570b43e73de0912c08c08d2abb86b54ccb42c17d71adcef43bc4e0f8f37c747469133a07a1e6b924f8d94f627c37
SSDEEP 98304:+mhd1Urye1g1w7IwCgRuMbdVLUjH5oxFb:+lViw7IwJHVUjZE
TLSH
T1C5262340F781C2B2D08524FAB89343EB99787F7C4665998B3FC92A2EEC649F56335143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2876-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/2980-0-0x0000000000400000-0x0000000000849000-memory.dmp