9c9bf25594438e8247a8c5ba8e874cc205abcfd3f44b01b60d6b3e7f619552ac

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260807-ntfhasfe74
SHA256 9c9bf25594438e8247a8c5ba8e874cc205abcfd3f44b01b60d6b3e7f619552ac
MD5 5a3befe6517eda60ecc5d9f8b8a5cec7
SHA1 d0a4bfde43d46df23220ebec60b45233c0825b32
SHA512 c441a923c79ece9345933ce80c52342f5b886aa5bb526625c9ae28cdcf6d736313e025ebde21975507c7ef23aecb96dffb65beae61681a2a231b25942ee9d1d2
SSDEEP 49152:ioa1taC070Uh8AM2VC3h39Ul7BWYQvOJFIRU:ioa1taC0T8AVCxq
TLSH
T105A50200B314F0F3C5056FB0665ADB5FA57029FB7B459CC73984278A19DBAC8A712F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1840	DBAA.tmp

Executes dropped EXE 1 IoCs

pid	Process
1840	DBAA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBAA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1840	4400	2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Users\Admin\AppData\Local\Temp\DBAA.tmp
  "C:\Users\Admin\AppData\Local\Temp\DBAA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-07_5a3befe6517eda60ecc5d9f8b8a5cec7_amadey_elex_smoke-loader.exe EF4F1075D9F727FF9C2A596ACC37A8E1771D7D6ECF6569D19BE97D454B958A64764A3F5A77B4F13D54FA1D987BDF28FE4DB88782FAC32965B0FA9397E275C6AC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DBAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\DBAA.tmp
Size 2.2MB
SHA256 d623e0bcc7a025454815f3a212d2e3b68f655dcbb77f8c62976c4a3b4bc42447
MD5 c03c719c0abd62a823a7ee95b7a19c3a
SHA1 285e2c2fc82e870c9a4b472cc9db83c8d08099eb
SHA512 a47f8a11d0af133d498e9deef0f1a6c93b9084466992e324ce31e0a59b75f51c8a648290e88f57869f9c9ca10e56242cd6929697a5110df7bc83fb367783c726
SSDEEP 49152:ioa1taC070U4O3QmgFYSGZKQ45BO7q3S9lGaRQvOJFIRU:ioa1taC0S7TlQsKca9
TLSH
T152A50100F704F0F3C5156FB0624ADB5FA67039FF7B459C873984169A19DBAC89B12B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download