ee48c53d2367d639894bb87100f5739c02050603389c850841252cc7acc3c73e

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e4bd69350ece26ca18ab2851971ee1a9_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260802-jpfkaafc63
SHA256 ee48c53d2367d639894bb87100f5739c02050603389c850841252cc7acc3c73e
MD5 e4bd69350ece26ca18ab2851971ee1a9
SHA1 264fb47e294051f8e88ca86a514727c37caa856f
SHA512 1450bb6ebac09189b67cec118fe2f6e8b79d638837c8e8b538ffcc01bf32dea0d8c5d69d731161faf4a3e05a7b72add36b38577ca9ef8b5c4a4f8abde829c062
SSDEEP 49152:+oa1taC070Ujp7jhR7xIut0xBX27+yK6RecFPHgM:+oa1taC0R9jrx90byDFPHgM
TLSH
T1A566CC50916AF3618A812930983EB259D4E4ADA487FC48F37D8C3AF5D773BE37532606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3500	B409.tmp

Executes dropped EXE 1 IoCs

pid	Process
3500	B409.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e4bd69350ece26ca18ab2851971ee1a9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B409.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3500	2352	2026-08-02_e4bd69350ece26ca18ab2851971ee1a9_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e4bd69350ece26ca18ab2851971ee1a9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e4bd69350ece26ca18ab2851971ee1a9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\B409.tmp
  "C:\Users\Admin\AppData\Local\Temp\B409.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_e4bd69350ece26ca18ab2851971ee1a9_amadey_elex_smoke-loader.exe 463C9BF8476EF8E7EA915F9966A3E1136970261899600C118E3CD76566DD9BFD3B0A99EF1AA967BE9585CEEBBCADD5760211C2FB1ADEA8824C507862629A44ED
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B409.tmp

Path C:\Users\Admin\AppData\Local\Temp\B409.tmp
Size 6.5MB
SHA256 8c63bf4c434c688d4ad75ab770da15e444a7ce6bbf2c66d0058a55c9854d9bcc
MD5 7568792446f9ac3a60e6fac0ed7e1117
SHA1 0cd2f5935912f4c988ed1ef0674ac534b21f8a88
SHA512 acad35f5e8494908372ca4b433dbbe64fa4a3ac825a2b5b6e81b772c17fdb0fb68cac2f5e935c18bad77ef0796b4d6956363cc2417d11b8408d4933146a48122
SSDEEP 49152:+oa1taC070UVAv7vAnlagdIdCI2zzHLF78kRAVb+n:+oa1taC0ToYpZzzt85Vbg
TLSH
T1CC66BC51916AF3618A812931997EB159C4E4ACA483FC48F33E8C3AF9D733BE37532645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2352-0-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/3500-5-0x0000000000400000-0x00000000005EB000-memory.dmp