858fc3dfdbaf886e2b45a2fd116d1506dc13f1d8cac527d288d2f0d2fb2c9568

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260802-xdklraec47
SHA256 858fc3dfdbaf886e2b45a2fd116d1506dc13f1d8cac527d288d2f0d2fb2c9568
MD5 48f7045a676229e1744a78d7f71533da
SHA1 9af5e00b321ad63cd6d6c055c59c4b9ffd3893db
SHA512 5af46912bb4ba91e77ce7ef078d342a452cd569da2fdfc16a5b80ec7a658844a3ef0bd1197befc90c65e222421594a43a7b9390e2fa1d8edac515ccddffc472e
SSDEEP 49152:Joa1tHC070UxL6DmJJPRKyXzOheqsHMJfg1o/HLy6ZzxLkKyGSp:Joa1tHC0rGAJPRjOhtsH0o4uUlLz
TLSH
T16C951259FA5881B6C05184BAD2A29BABC873387953004ECB27D59F6F1E27EC47630763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4844	E6A7.tmp

Executes dropped EXE 1 IoCs

pid	Process
4844	E6A7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E6A7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4844	4812	2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\E6A7.tmp
  "C:\Users\Admin\AppData\Local\Temp\E6A7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_48f7045a676229e1744a78d7f71533da_amadey_elex_smoke-loader.exe 9A0EDAB8857FAC0A7C36893D00AFABC9ACD95258F0381CDF2C8D540ACB83771612DB89656442F9E2E48FC4D74484057BA58F80B351C413102481C58D39304FF3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E6A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\E6A7.tmp
Size 2.0MB
SHA256 c3bb70824447c9a43584d1377a0a27a46b13731a1d0f42d96501bf90f7bef104
MD5 b307eb2835fa3b22e3be95ef737e5818
SHA1 3775e98449b4b26b3abb8d00eb8f55609b07e42b
SHA512 09f4f9da265e65edebfee601aef8e7921407bc06ce36050f02a22f28085f697e6e72ffc82d708e976b9473e54fcc38c154dca01f8fd84fcc65132ff45e19f9a1
SSDEEP 49152:Joa1tHC070Udq1Lk0EtZm+D/Q6wiTDP3K3sl1RZAap:Joa1tHC0W1LX+DolIr3KGS
TLSH
T18095125DE6A881B2C042C87AE562CB57D0B3387A57014DCB27E64F2F1E27AC57631B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4812-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4844-5-0x0000000000400000-0x00000000005E6000-memory.dmp