e63a552ab994d80b9b37c503c62c6f9df04fb92e9916b77e3aee5399cb4e422e

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_d0949f3870040f20c34af012d1efde41_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260804-wpf72abl8y
SHA256 e63a552ab994d80b9b37c503c62c6f9df04fb92e9916b77e3aee5399cb4e422e
MD5 d0949f3870040f20c34af012d1efde41
SHA1 50d5bd2508ea951faef5233314b25d59c45f5246
SHA512 6764cb516f555f3cb176054aafb061af078500ea904687e24bb461989baa9ab9919cf3d4fb0b50c8cf252ed05a572c3a8a89d1677329208948e853402a2ae8f0
SSDEEP 49152:Joa1tHC070UNJA2SkJsZ+L8Usjr37TfaTu54087n3zaKZp:Joa1tHC0DJVSSL8H7TfQu8DD
TLSH
T1A5951209F76481B2C051D5BAD6A2CB57C873387663004DCB6B918F7B2E27EC1B634B66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4796	2268.tmp

Executes dropped EXE 1 IoCs

pid	Process
4796	2268.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_d0949f3870040f20c34af012d1efde41_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2268.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4796	4524	2026-08-04_d0949f3870040f20c34af012d1efde41_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0949f3870040f20c34af012d1efde41_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d0949f3870040f20c34af012d1efde41_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\2268.tmp
  "C:\Users\Admin\AppData\Local\Temp\2268.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_d0949f3870040f20c34af012d1efde41_amadey_elex_smoke-loader.exe BDC8AF0E7B35F0205645AF4B09E1E0A1B82B7AFD78976CC523E54637F6021B7666FAEED766FBE0885373F655C98357DEE1ED857674EA30A0541CF2C97AC528CA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2268.tmp

Path C:\Users\Admin\AppData\Local\Temp\2268.tmp
Size 2.0MB
SHA256 34b0f7a40622ebe51760c4a87d866077cb448248ddfa22ded191ab023c8f6717
MD5 9cc8b8e0cac3cdee846be7ca364be35d
SHA1 9bc113c749270ad8f3a55954015fad8557abfb5b
SHA512 22e16f5b6a406d1a3290a1f99750e84e92b64b0a3e8bec26441d64e38f217b8834feceab6ecf352882fc16242ad661ca1f7ed9597635b1ef784314795fe14701
SSDEEP 49152:Joa1tHC070UQHX5cunFi8iJixkCtTXSiQd9srp:Joa1tHC0epRFi8iJixkCtTXbQde
TLSH
T116951258F7A480B2D051D8BAE592CB57D4B33C7A57004ECB27A58F2B2E27AC57234B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4524-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4796-5-0x0000000000400000-0x00000000005E6000-memory.dmp