c7d0f3162670fd6b2feec6f0a329a4727edcd0a549ef6a6e0f425a0277b4eccc

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260802-xt892see97
SHA256 c7d0f3162670fd6b2feec6f0a329a4727edcd0a549ef6a6e0f425a0277b4eccc
MD5 2ef67f5acb0a0806a57b066ee7dbda33
SHA1 689bb7a55b37c614fed712b527c648572f8a5690
SHA512 be41f7c8e092f3e4bce7405a92efef69bbf1b3ee6466a713f743f34d59f25b6eb364b605cdfa8331ad94047c4d59d7f748f4cb1bf2b859ee6c331debc2b38ae4
SSDEEP 49152:foa1tqC070XlLfER5TQbYLeKaQDMhoO4lz:foa1tqC06gFQbYjah
TLSH
T14CA50200A3E68171F0B3663199B282519D773C7867F19ACB2EB4DA1E1E71BC09D75B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4020	5772.tmp

Executes dropped EXE 1 IoCs

pid	Process
4020	5772.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5772.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 4020	560	2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560
- C:\Users\Admin\AppData\Local\Temp\5772.tmp
  "C:\Users\Admin\AppData\Local\Temp\5772.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_2ef67f5acb0a0806a57b066ee7dbda33_amadey_elex_smoke-loader.exe 31BED0030357CB5FA9A45970D3D85E8D9252AF76DD65434B6377DBA3190B62C51E3B69FDBDB47302657ACAFFD634DC767FB2FAFE35859408074A47307894BA32
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5772.tmp

Path C:\Users\Admin\AppData\Local\Temp\5772.tmp
Size 2.0MB
SHA256 abc4c3bab9f854a0f9113299e0be64ff1d96722a475f90aa521824c6689cf18b
MD5 4b80a20d687d93b2955fbf445c072e21
SHA1 b55436331c3e7ffe1014b7248f02f4143f24202c
SHA512 925b6051bb3eeb00393d4eaf2b719a65a2f2869362e5684780159b523590b80c2ed0ac3b0f1c43265eaec0134d45e0b1233326dc0e294e6d249ccd2d1f62acad
SSDEEP 49152:foa1tqC070XPNY/1Ut4zUyNMKY9Fc4Llz:foa1tqC0pzn2y
TLSH
T19CA50101B3E68174E4F25630A9B282529D763D7857F19ACB2EB8C65F1E31EC09D71B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/560-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4020-5-0x0000000000400000-0x00000000005E6000-memory.dmp