d3530cfceb3b71fc92e2fe0ff63fd9ad7ecdb812749de25fb92947956bfa3c50

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f4c58a029159ed34fdd76baf8fe41264_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260803-tyjcmsvxfx
SHA256 d3530cfceb3b71fc92e2fe0ff63fd9ad7ecdb812749de25fb92947956bfa3c50
MD5 f4c58a029159ed34fdd76baf8fe41264
SHA1 2813a01cf4a1b82dfe1ab12b2ebad0f343b846bf
SHA512 6a594be094bb5af7249796815e85823bbe7c73fc7f21867bff38c6249b0af86fa2f73d38e3db234c5a89d680042d9cf924dcc7d354ab3d6da0cb35c173b747be
SSDEEP 98304:emhd1Urye1AUohAuXS85a3HV7wQqZUha5jtSyZIUS:elVAUoDXvA32QbaZtlir
TLSH
T19B56BF05EBE8EF1EC51F03B590B2222657FAD894E783AFD6A941F5B07E82350BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4648	FD7A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4648	FD7A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_f4c58a029159ed34fdd76baf8fe41264_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FD7A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 4648	1284	2026-08-03_f4c58a029159ed34fdd76baf8fe41264_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f4c58a029159ed34fdd76baf8fe41264_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f4c58a029159ed34fdd76baf8fe41264_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\FD7A.tmp
  "C:\Users\Admin\AppData\Local\Temp\FD7A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_f4c58a029159ed34fdd76baf8fe41264_amadey_elex_smoke-loader.exe 54E78AFC4B1F76D496DBBC18D8DC257728800542DA7E5631D4C323A31C67109984F3B410A0AC42E7339192DA64FDE6EBF1676F37A06BE89DF535D19639569BF8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FD7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\FD7A.tmp
Size 6.0MB
SHA256 771b0db36aac271dc339684732504cfec68e96a12c0ac049ea55f2b05fd80f73
MD5 bf0d7653b36403c11ca004e3456c062b
SHA1 71ca17b2838943165a8172f3fd1f4b3d90cadcbc
SHA512 8d3de466e54cf982de027f27d3af8c9172ee9ef0307de40fba4ba55f2ae9645af1af2dfe3eb23689ab3e45e2d6b23239e3c429069301a93a0e88beb0476c6ff7
SSDEEP 98304:emhd1UryepVqhEoqivGNoDYV7wQqZUha5jtSyZIUS:elzqnqmG92QbaZtlir
TLSH
T18556BF05DBE8EF1EC91F03B590B2222657FAD894E783AFD6A951F5B07E82350BD02153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4648-5-0x0000000000400000-0x0000000000849000-memory.dmp