e6eb760911688767db6f0c61e421bbf3e9b45790267fb53beb347404d90d0ee2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_a20af90b521e617a0504ad95ab6fc79e_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-vzelhsdl2v
SHA256 e6eb760911688767db6f0c61e421bbf3e9b45790267fb53beb347404d90d0ee2
MD5 a20af90b521e617a0504ad95ab6fc79e
SHA1 8ccacd967b5ec44d522b75c09f3e8963933669aa
SHA512 1050172dadfec7c286a6ac7c414f437d5dec9fad1974b99dc6650161b9d3a5d3ba1eef2c061654e63995e50b58b924203b0eb7a17e915e5cc745a6b062219132
SSDEEP 49152:Qoa1taC070dWiSfiHfKgyeplDLJV8rTd4AmEZCYn4ErZU5/:Qoa1taC08mcfG6vcrTd4At4Ers
TLSH
T101952310F79481B2D0420AB5A662C3E398693D7D97029DC37BC81B3F2DA4FC56A36B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4876	4949.tmp

Executes dropped EXE 1 IoCs

pid	Process
4876	4949.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_a20af90b521e617a0504ad95ab6fc79e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4949.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4876	4896	2026-08-02_a20af90b521e617a0504ad95ab6fc79e_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-02_a20af90b521e617a0504ad95ab6fc79e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a20af90b521e617a0504ad95ab6fc79e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\4949.tmp
  "C:\Users\Admin\AppData\Local\Temp\4949.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_a20af90b521e617a0504ad95ab6fc79e_amadey_elex_smoke-loader.exe CE587BA7CBBB39D84A1965B1C45D62C7081D740EF54B35F6BA54506C8193E81A4239462642A527DA383422CB02AA6C3B89135EDBCFE73BBAAD8081E0D2E5B33B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4949.tmp

Path C:\Users\Admin\AppData\Local\Temp\4949.tmp
Size 1.9MB
SHA256 5475dfd3b9581abeb53161f9abbe7f92607ff945591d59f5c6ea010bfb3f4950
MD5 12a6cc9c44fb8f54faa42a98cfdfc86b
SHA1 b45a94074978aa0670d4c9a1dfaf7f918f32955e
SHA512 9022a55dc7323c3e2157835c77f5a426fb044514c846f4e9e222d037da075da925fbcc412769171a7097a5c9d504ac7e9f065d03af7580771179bf5f755968f3
SSDEEP 49152:Qoa1taC070d2zp72dpKW/snHqbKX8ZgOXB/:Qoa1taC0NzpyhkdX8Z7Xh
TLSH
T182952350F7E4C2B2D4864675A652C6A2DCB53D7D57058DC37BC81A3F2EA0EC06A39B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4876-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4896-0-0x0000000000400000-0x00000000005E6000-memory.dmp