a235f6fd0e7d1e6e7dbaec8aa7d7a941d8e1bff4956bde34a5cf84654e54bc41

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260804-v4fpdaed44
SHA256 a235f6fd0e7d1e6e7dbaec8aa7d7a941d8e1bff4956bde34a5cf84654e54bc41
MD5 f208e28c66d799fae88282d774bf1078
SHA1 7e4a015d21ef7efdbd2a7dbb6202af12106268b9
SHA512 e08123811ba08f4a6703e78c7e6effa52a3a8568535213fae3a795e7b88d36c983d201d66a1c6d511a23bf281a715772a8bc02decbe0d7e16edeee8cad1156ec
SSDEEP 49152:Qoa1taC070d49QdDRrQJ/o6Xomydv2e4u:Qoa1taC0tQdDado6oZd/4u
TLSH
T1C8952210FBE1C2F2C4800A72A1A2C7E69CB97D7956418C83BBD81B7F68D0EC4A675757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4684	4F25.tmp

Executes dropped EXE 1 IoCs

pid	Process
4684	4F25.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4F25.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4684	368	2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:368
- C:\Users\Admin\AppData\Local\Temp\4F25.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F25.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_f208e28c66d799fae88282d774bf1078_amadey_elex_smoke-loader.exe B2BBA663A0220917D33DF2444D63AE047DF7B5D8954BACE3C613EB4A5D05396549999CA3D3AD4E7B7DA5519B53C8D15DD13E2F9269A2A9B56BFDF02A4A71AA7E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4F25.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F25.tmp
Size 1.9MB
SHA256 afefc91d07f55aab540c3764593ed40ee78f23f4fa0a780e8ca594db71e1b495
MD5 5aaa29f2708358601b0591b2a2f45d9c
SHA1 0eed32781b012806bb7a0b552cffb9de3f3e7c7a
SHA512 384c2755833d10f3e5f00fadb4b9db36b3247a87d9c7a23e57e3c5df0ef8213146358abc6a331d891f93d76612ab93d01094b25d522d85ced51804cc8a7439bd
SSDEEP 49152:Qoa1taC070db3bsioy92H4jG57xtVFb7spzgKiVot:Qoa1taC0A3broy9e57xrxstgBVo
TLSH
T1C0952250F791D2B2C0915B71A692C3E6CC793E7C4B458C87ABDC1B7F1960EC46A22B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4684-5-0x0000000000400000-0x00000000005E6000-memory.dmp