6854043a5a8ff6183e908b23fb977bbec2cd86f7203d21d3ef54449e6c0daff0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe
Size 4.2MB
Sample260803-hdctksdk2w
SHA256 6854043a5a8ff6183e908b23fb977bbec2cd86f7203d21d3ef54449e6c0daff0
MD5 c50d8166224ab8416a0a4027b5d9fc27
SHA1 de06d2914fbb6d7ff3b45dc4424ab8aaaa89935e
SHA512 5de4cff3bc702a8e7d7c94a84d1d149a561564aa5c1ba984e4c5e8f3b56f6f0c4551a886becdeae9f5750a764b0f4e21c0a7be95e264c8050134f626b328ea7f
SSDEEP 98304:emhd1UryeZSer+m5FEfaRdVLUjH5oxFbxCVLUjH5oxFbx:el4er+CfdVUjZEdCVUjZEd
TLSH
T100262340B7E4C361D08375FD508343EADA343F2D552AA68B6FCE1A2DEC689E27275742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3416	53C8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53C8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3416	1596	2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\53C8.tmp
  "C:\Users\Admin\AppData\Local\Temp\53C8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_c50d8166224ab8416a0a4027b5d9fc27_amadey_elex_smoke-loader.exe 150203C85A55105909B698957985EC2C99ACBBDAB84E17575732491F5E20151FF83C559CB7E12E7E10E5468FB3FEFBD3B2700A0C7BD083EEDC41F76F234F11CA
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\53C8.tmp
Size 4.2MB
SHA256 64ea483b5ef896c3ea91d6fe639d8ac9b52c60e12d36050663d5da8af03ef930
MD5 0af8dc0c2c69e3f6c0fa36f6db9933a8
SHA1 48d44782ab00500c477e4b2d415716b93e1721a9
SHA512 edd34f4bcb39e8c53faaaf124a9a847ad2565418524d280330175b9d52b5a1e294538810fc6fe5b88f2af604524bf2dfefe1afc719eee6a608553f55ba3a0b10
SSDEEP 98304:emhd1UryeM18wrFYTDUHVLUjH5oxFbxCVLUjH5oxFbx:el+8BEVUjZEdCVUjZEd
TLSH
T17A262381BBD4C262D1C275F9248343DADA347F6D1175D98F2FCE2A1EECA88E23579142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3416-5-0x0000000000400000-0x0000000000849000-memory.dmp