d2f3422befa25f6f6e28a2f45afe2f9f81789bbf16230536e6f501b06aa023d6

Analysis

max time kernel
149s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260807-tek25agn71
SHA256 d2f3422befa25f6f6e28a2f45afe2f9f81789bbf16230536e6f501b06aa023d6
MD5 6cefe5d0a4f3a4a9cbac8074c536cef9
SHA1 5d933d859b9fef2a30810a87560d63b65f3bbd08
SHA512 5d7b0bba5de62e4acc7a65f630f9c7ccf25dadeb648d8ad1a13e65dbce5a105fd3e1e1cdf12dfe109c7ed537370ea74a6361ba47b6774686827cecaa1596ca08
SSDEEP 49152:4oa1tEC0706YdzyrfwUT/voaruB2IADt3OS:4oa1tEC0EzyrfwUT/U2IADF/
TLSH
T10C952361F7D1C1B2C0420631AA92C7A3ED653DB89B059C87BBCC1B6F5D90BD06B62B53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2820	356.tmp

Executes dropped EXE 1 IoCs

pid	Process
2820	356.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	356.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 2820	5316	2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Users\Admin\AppData\Local\Temp\356.tmp
  "C:\Users\Admin\AppData\Local\Temp\356.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-07_6cefe5d0a4f3a4a9cbac8074c536cef9_amadey_elex_smoke-loader.exe BD3EA55EEDA117148DB616F9672B99939A3D16E37D9F8370DDBCE4ADE20F8A2BF424DF2654C584022B67903EF4743BB815E226145888CC6707E83EEB6C7395FB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

356.tmp

Path C:\Users\Admin\AppData\Local\Temp\356.tmp
Size 1.9MB
SHA256 9228cfcdaaed65ccb515a23c8f0c6e1e9084e46b70bd6db442a485f74e2e4a55
MD5 0c44022a8f2057300f56d8fe444ce847
SHA1 cb68972aae9c5c6ad6b89fed4e3f6efff65094b1
SHA512 3292cb6b4d3338dea4617cb949f3c824f750cc3e323aff55cf1928d2fea81a18969e0fd5ca6827ba32e43f40d95b0121b2c98aff8800cff1b1befb74dff5b1b1
SSDEEP 49152:4oa1tEC0706/n+XoI7Ke+uNaJFWWw/j5GSaTP:4oa1tEC0LSoOKKYJoWwwSaTP
TLSH
T143952350E3D5C2B1C0810A36A991C3EAEC693E3E57459D83BBC91B7F1D94BD06A72B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2820-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5316-0-0x0000000000400000-0x00000000005E6000-memory.dmp