183694aa646242ea6e1c9e910cd8acd7c7fa88c77481fac24d3e57820864756b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-tk8els1bmd
SHA256 183694aa646242ea6e1c9e910cd8acd7c7fa88c77481fac24d3e57820864756b
MD5 3e39d5f8c0dfd113daab96a079de4b98
SHA1 8c99c8c027be8067c55ed6161837b48bc9aba78b
SHA512 37cd2a30acdef5ecce9039f195b95a510aab055dc2ed81117bccdc52a9888387372fc809e6eb0aaaa240c7c1249cb4bb5a704c893eaec43c5b7a9fbdecd91b87
SSDEEP 49152:Qoa1taC070deG8aat2VlQHtCpq8gvM5TQ2w1yLo9W0uk2:Qoa1taC0XqaYKCp5KM9MULd0uv
TLSH
T1B4952210FB95D2B2D0811632A656C3BADC793E7D46419D837FC8173F2AA4EC0AA32757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2836	F18F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2836	F18F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F18F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 2836	4584	2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\F18F.tmp
  "C:\Users\Admin\AppData\Local\Temp\F18F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-05_3e39d5f8c0dfd113daab96a079de4b98_amadey_elex_smoke-loader.exe B6898C25AACE8D2FC1DF5686D4B94A5A044572081E180457C1ADC46B73AF45660AF21C5A8C68F70CA5E704B26CD246075D706F5920961DE7673649775FB81D4F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F18F.tmp

Path C:\Users\Admin\AppData\Local\Temp\F18F.tmp
Size 1.9MB
SHA256 aa8d60a528d38e031bfdcc06dbb669d76f592e2f67f7f0870e3f07be735dc1c8
MD5 96f1a608f1e547dc3143784a236c8c14
SHA1 6d485239557e98f9d02c719b0bf312998ecf58f8
SHA512 8ad72a5b9e3a21a2b684dd9c38f7c96e2c2d54dbf76775f51b2ed064b51507cb7f19811f267febadd510ecdecabb9f5cf48fc7650a2c2a54fb1c0cef68160899
SSDEEP 49152:Qoa1taC070dtyvi+WfkFL128aA+/ynK9hSk:Qoa1taC0pWfkL121d/uK9hSk
TLSH
T123952351F7E1C2B2D0410970B291C7E2A8B53DBD57429C877FC92A7F28A0FC0AA65B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2836-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4584-0-0x0000000000400000-0x00000000005E6000-memory.dmp