5e73bc6578e6dc65e4e0241ee8c28afa0d344a6a706229689ca1d03f1a53a9e2

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260809-vceb8sam2t
SHA256 5e73bc6578e6dc65e4e0241ee8c28afa0d344a6a706229689ca1d03f1a53a9e2
MD5 53067a53d93ea325a2294281869cf9fb
SHA1 710fe53a112c8151b6f8c4bd18b09f122f4d4167
SHA512 10374fd4c710cbc3c2ad1ce8a0273e9705f23547d36c442247bad0e79ac8a2de8fc827d6dcfd8aa673f7f64c79d973b4c9c1aa749353ac998a4b7415aa1a54fd
SSDEEP 49152:4oa1tKC070EOs8uRS5M/kAD5sHZlTBQub:4oa1tKC0oz4SwkO5s5JBjb
TLSH
T11A952255F7C5C2B2C4910A70B562C3E698393EB956828D47BBCC1F3F69A0AC07672B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2628	57DF.tmp

Executes dropped EXE 1 IoCs

pid	Process
2628	57DF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57DF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2628	4396	2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\57DF.tmp
  "C:\Users\Admin\AppData\Local\Temp\57DF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-09_53067a53d93ea325a2294281869cf9fb_amadey_elex_smoke-loader.exe 2251D24AF996D547F4852B8C47FA5DFF937FC098370B2B9259360CF3A251C4E932EDBE4DA8884F687042B2A4B72798B65840E9349CFA35906FFB3D7381AFFC77
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\57DF.tmp
Size 1.9MB
SHA256 efc9d896170d35879773bec496b785b021a9fbee5d951192fefa60d4750aa874
MD5 378ad79845fad4e929661dc4bfc35d9c
SHA1 c16c37559cf510c7fc2c121448b924b3bfaa73d8
SHA512 7b5d96c3f8640e7eda4fe9d4696953820d86597d0f3702f3a2cad49f95d5db7064639a64a6b77acbfb19770e221de42d123741070d298a564dcabbfc0a88436b
SSDEEP 49152:4oa1tKC070EBVlmTEs58kyp78euNicWu1wYb2Bv:4oa1tKC0zVQow1KXOuv
TLSH
T1B2952221F7D0C2B1D0810A75AA61C3E7C8792E799B454D877BC92F7F18E0AC4AA35B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2628-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4396-0-0x0000000000400000-0x00000000005E6000-memory.dmp