1fb04b59133d02db9d697cb88c087d0d84a75824c5985d95747fd2f924c39120

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260809-ydpfdavbqa
SHA256 1fb04b59133d02db9d697cb88c087d0d84a75824c5985d95747fd2f924c39120
MD5 99e7ccd0ae31a39cd04e84d130551ec8
SHA1 77ecfa4bb5bae773f847528b9da05e281f5608da
SHA512 452d24ea0fe65b00bb8f40ece776bb8a722ad17aa4a2c7c3fece90d7fa5b3a886e76b28275d5738dfd9783f8bcf9d518396f15d2847640e746fd5d3b44bd5f00
SSDEEP 24576:I2oo60HPdtf1CRiY2eOBvcj3u10siD1rACdQz1NZe2CWnj6goHcBSpxRr9e3srpu:toa1tNC070siD9TdiZZnjRer9isN8We
TLSH
T1FB952361FB91C2F5C0950671A661C2E39C796EBC8640CC83BBC91B7F6DA0EC06A35757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1188	175B.tmp

Executes dropped EXE 1 IoCs

pid	Process
1188	175B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	175B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1188	552	2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\175B.tmp
  "C:\Users\Admin\AppData\Local\Temp\175B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-09_99e7ccd0ae31a39cd04e84d130551ec8_amadey_elex_smoke-loader.exe 4D2E463F7A79621A1E4016A156983F23FC701C6B1338FC12936D9CA0160BDAFBE2966B800B6EB5CFABE098C152B42531A018284DA32D93DA9F90AB1A6281B240
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

175B.tmp

Path C:\Users\Admin\AppData\Local\Temp\175B.tmp
Size 1.9MB
SHA256 c2ed50f38d5a4a47f5946fa46602d413403f6cd920373fac647df2fa675ee596
MD5 ce9da7ac2444d1940c1e5bb6fba59c95
SHA1 9a8ddcf42d8dbd3b0557027c1b924ffe3aeab49c
SHA512 8ad748ba22cbf2810ecc521f57e416153ca7234c042ab880ee094425db46343e68539633f4ec7905b8b7c44645e114d60285a8c6b405bc6432cb947a27e12313
SSDEEP 24576:I2oo60HPdtf1CRiY2eOBvcj3u10sAFNdLKebXK1WfsGj9+nQ+YLqWXznQxzfelpm:toa1tNC070sQXgWfnARWqzfeyESQN6
TLSH
T196952240F3D5D1F6C4D10AB1B152C7E28C6A3E785B459C837BD91A2F2DA0ED4AA32B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/1188-5-0x0000000000400000-0x00000000005E6000-memory.dmp