dc541a805bd19815da64f056124228bfaba5ce15f4cd33a2ae65439a7fab0d5e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260803-v6rvesvalh
SHA256 dc541a805bd19815da64f056124228bfaba5ce15f4cd33a2ae65439a7fab0d5e
MD5 8733a514f7bda6d7e2913559c83ef321
SHA1 044408668e98c414b8473f5f5c1c210fa680fff0
SHA512 827307ded449cc3fc443b6e98625768ab9d3e9b70ccd4466624f9ad72835256bd1d94135318df35b0956289752bc1fcbe7ffe3cee148dc2097d38e3f55e9bc1f
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dB8+4vNKf6jht5c+wmGhvVOKLu2/3dpywYpr1:Qoa1taC070dB8Dveef5c+eV/D/SMSVz
TLSH
T1F3952394FB86C2B2C4860A71A191C3E6D8693E7D4651CE87BFC8077F2964FC05A72B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4340	4FC1.tmp

Executes dropped EXE 1 IoCs

pid	Process
4340	4FC1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4FC1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4340	4376	2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\4FC1.tmp
  "C:\Users\Admin\AppData\Local\Temp\4FC1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_8733a514f7bda6d7e2913559c83ef321_amadey_elex_smoke-loader.exe 91AB2060C9CDB6398061669FAE04BEFBF35C17C03E9697D7CAE83161AAEF22097B90108BE6AB283B5A382B23A2653172E7659A311A16004E7EFFF188EC6F91F6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4FC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\4FC1.tmp
Size 1.9MB
SHA256 43b1a9ad123828fd58c4e7f98011a0188efcf57b8af232a75c97b79d4430ea03
MD5 6cb868f017d914dec76b694ac784dae0
SHA1 c0d68ce2858ed84bdf086314b0b7f344e303c8d4
SHA512 e277097d844e4106c541879e34412c67afdeb19bfbe31744d3cd6096673f07e48f0ac9cae30ad10d94510c4975bb770de3f9aeb6f0bfa293d8498d90f6c8d94e
SSDEEP 49152:Qoa1taC070dHaTmGRavafhZEX4gzqiHFY+A3IS:Qoa1taC0iajRLfhqz9xqIS
TLSH
T1D1952361F7D1C3B2D0D11176B5A2C7E2D86A3EB852064D83BFC81A3F29A0FD4666174B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4340-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4376-0-0x0000000000400000-0x00000000005E6000-memory.dmp