bac80dfb0eff462261716a12c36bdb1e850c4c0c2add53d5ea2e9629d956ddcc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260804-tr5x3ade85
SHA256 bac80dfb0eff462261716a12c36bdb1e850c4c0c2add53d5ea2e9629d956ddcc
MD5 2e58f528c5dc4e3d69879a93faf131a6
SHA1 211cd2270c9ab51b19c4639ccffe33638ebeeb50
SHA512 90f822d011b68ed7991002554b8bcfa60114bb931f574d9f320269487a9db6b4d61a63f17f8b6442cf546c82274ce73ee9a08eaafcdcb92d22084adb43314001
SSDEEP 98304:emhd1Uryeoo/duz+Bfr0+V7wQqZUha5jtSyZIUS:elIoFo+BzB2QbaZtlir
TLSH
T1B956BF05EBE8EF1EC51F03B590B2222657FAD894D783EBD6A951F5B07E82350BE02153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1692	4D50.tmp

Executes dropped EXE 1 IoCs

pid	Process
1692	4D50.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4D50.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1692	4456	2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\4D50.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D50.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_2e58f528c5dc4e3d69879a93faf131a6_amadey_elex_smoke-loader.exe 321303FA7A58A89D1CE428DDF0F0FF71218B6C06E0BB1642D6203E1E1BFB07EF000580D64D6741426AB36B45DD5EB24F549413A119116CE91EB2D68ED44FA50F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4D50.tmp

Path C:\Users\Admin\AppData\Local\Temp\4D50.tmp
Size 6.0MB
SHA256 0319dd359b8e15c0910c70b9c110b3993d5c0486d553e6f3b3b4c0075336f01b
MD5 ad040d7848c79232c43659b5b8833605
SHA1 8f08cd92b79683340d9273b6254424e7b607b273
SHA512 3d5c8e244c680f210c659e3e40f3289d0ec7ea74ec3fbae49dc21970a99eece195274937db6c07f3487a68b09b02cf1ce37737e1a48e41761c961aa17aab02a9
SSDEEP 98304:emhd1Urye83ExixonV7wQqZUha5jtSyZIUS:elc0gQ2QbaZtlir
TLSH
T16D56BF05DBE8EF1FC91F03B590B2222657FAD494E783ABD6A951F5B07E82350BE02153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4456-0-0x0000000000400000-0x0000000000849000-memory.dmp