08f70ea73f6f5448429a8d48246b0312021935633b5ebf93f97359b43593ef97

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260802-wddb1ade43
SHA256 08f70ea73f6f5448429a8d48246b0312021935633b5ebf93f97359b43593ef97
MD5 889432d0820d4ce4197302292e77131e
SHA1 269c418e4519fbea4b71d1ffc52ad1ead73a85bc
SHA512 8d587d692c6d4e8259cbeed3d0a7608af69800471ca4c90ac7b9326eb0b44937f9c27716a91f8669d67870419a84d1ba7ff949200c7259b09d89fbb0d6492ed8
SSDEEP 49152:foa1tqC070Xon3YPkyaDSQGx4eeD5moxsddlz:foa1tqC0yYGhx4eo5HKd
TLSH
T1D2A50101B3E68170F0E21A3495B282519D763D785BF59ACF2EB8D61E1E72EC09D71B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5640	579.tmp

Executes dropped EXE 1 IoCs

pid	Process
5640	579.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	579.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 5640	4660	2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Users\Admin\AppData\Local\Temp\579.tmp
  "C:\Users\Admin\AppData\Local\Temp\579.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_889432d0820d4ce4197302292e77131e_amadey_elex_smoke-loader.exe 985C347B8B2F52380964F175B59545F189B4DF0D8C3C1DE5E6D1A66D68C1C04D291D70397E848EDCA92318FBF7CDAE503E2EF7159688E2AD31F98BE969441D0B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

579.tmp

Path C:\Users\Admin\AppData\Local\Temp\579.tmp
Size 2.0MB
SHA256 5f529b8d2cd728c85cce85ce58893c3684a70c2cdbd38d7288c722373710be98
MD5 78ad2aee335bb629f7928f072435e972
SHA1 a7cd295c564a267f44db0bccf93160e140c774d2
SHA512 4814809c5289636b6e35e670d123148790bae6a9b2a59d054d696692e654e1984741dcc28f34a7947904419de9da8acf8818cd078608bd41bd2bde1135877b0e
SSDEEP 49152:foa1tqC070XVpt8izNwz9tpMrQt2SWznaXgWlz:foa1tqC02ptFacAWzJ
TLSH
T1A5A50101F3D28070F4F75A30A9B282559D763C7857F19A8B2EB8D61E1E76EC09871B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4660-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5640-5-0x0000000000400000-0x00000000005E6000-memory.dmp