1b338b553a2dea9526bbd78291f31b880c18aae5cdf238e82b788ece0d5f58cb

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 04:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe
Size 2.3MB
Sample260809-fkhbjagg45
SHA256 1b338b553a2dea9526bbd78291f31b880c18aae5cdf238e82b788ece0d5f58cb
MD5 cf5d9275c124e5ffc1f1bd3a3042486e
SHA1 b6226b80bd67eca1297625727a6ce04656848726
SHA512 b5c5ebbedf0fefbed96ea6d4e72c771eb0ef69396dd922d03f1201fb1ce9a05446ae1ceb9aafb80f7c366e860b134836f3ba03718828f5c0f97396723005f76c
SSDEEP 24576:r2oo60HPdt+1CRiY2eOBvcj3u10UG2YOq9kPvrd2hx2LpBJZiV8DZUBJ7SCU4ibu:yoa1taC070UGJkP52CLo8DgibpS7ote
TLSH
T1C0B5F053FB8586E5C65D0536AF504285922EE931AA0F57523A8C031ECF53B8B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5640	3F3.tmp

Executes dropped EXE 1 IoCs

pid	Process
5640	3F3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 5640	4568	2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Users\Admin\AppData\Local\Temp\3F3.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-09_cf5d9275c124e5ffc1f1bd3a3042486e_amadey_elex_smoke-loader.exe C89ECD803FA62F95EFAB9A471DAF05A88FEFD01046194397C55AC52E995DF6752F4D385BC1E4B3F13F2909A405BBEF4F40714166E16D75E85F4B8AE888BC2C26
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\3F3.tmp
Size 2.3MB
SHA256 1ba7f8c493ed339a8bbf44b144f611441f496c7b31250c5f84483c85cba35070
MD5 201c4ccea5979e2083cdedf2d1acc925
SHA1 fe253a3e61d9db5d1e26c0ae0cc1e5bf01ecaaa7
SHA512 3f98a34fe42f6e221655688994e80c8ae5da0caf045f71559e55f57e1780be9a63f3d70aabe9615e24649ebf053b4790a2e7fd7c300009ccc2ae5dbeee84f455
SSDEEP 49152:yoa1taC070U2XeBKSHrm392/2IiMXyaoctM:yoa1taC0kXe8wm3Ijiyyao
TLSH
T1B7B5F053FB9186E5C25D0536AB644281932EE9316A0F5B527A8C031DCF9378B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download