790b9a39ced262aa7ad3463d7480e4401da5c4813ec08f25ecc15e936d628716

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-rm127ssenb
SHA256 790b9a39ced262aa7ad3463d7480e4401da5c4813ec08f25ecc15e936d628716
MD5 c00750546bc655138d089dcfa7ae1e3e
SHA1 b15ff2a7fdbbe2e7a1f0186d4ddd11b499e1c0d2
SHA512 2e091d22be907106388572de90e2f22bd25101c6e41a3e383e1186225f5adfebcde4d0e11ab33e96222c26163a26feb4b252bc220dc9630c73203aa80d7a0a6d
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dfeXzZRyfMCyIxJ9C96GWd47hjK0J6cS8iw7t:Qoa1taC070dfe1RZIxfcZ3Pivs
TLSH
T15A952360F395C2B6D0910531A9A2C3F7D8693D7857448D873BCC2B3F2A64EC4AB75A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5160	366D.tmp

Executes dropped EXE 1 IoCs

pid	Process
5160	366D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	366D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 5160	5812	2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Users\Admin\AppData\Local\Temp\366D.tmp
  "C:\Users\Admin\AppData\Local\Temp\366D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_c00750546bc655138d089dcfa7ae1e3e_amadey_elex_smoke-loader.exe 74257C7E1BA106D7229EC9824E31BB004629809AEFF8880F376AD12AFA9C7C585A3CDFA346955BEFC8BDFC7254FFCF7A9A63B909A814873F168D8037C8B5AE51
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

366D.tmp

Path C:\Users\Admin\AppData\Local\Temp\366D.tmp
Size 1.9MB
SHA256 2d288d71975eb6cd2e80711207953a9064c5b9fe66cc682302b3d346ef54260b
MD5 3ae1df297eb823d0792405b11b66de78
SHA1 8ce728720eb74aeafb4d00ed73a8434ed0d6e96e
SHA512 5d1fee488fe6526ffda09cb162d328d1ec60ea320d999cbc7a1664f8724b873575e9f1afa2c00e9dfc337fc95bf8951794358f7fb9a5b1d9ee4b4995496c5811
SSDEEP 49152:Qoa1taC070dQ/oH4RqgaOZlLMoYsRQyECfospb6NPkNI:Qoa1taC0YYhOoF2H7spGNca
TLSH
T1D0952225F7A4D1B2D0821630A5A2C7E29C763E7D9744CD876BCC1B3F2AA0EC45A72747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5160-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5812-0-0x0000000000400000-0x00000000005E6000-memory.dmp