9f19410379906ed109a214b195d705cd5e1c0b97dfb3c557571551449db87812

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260810-vpdapsdn8z
SHA256 9f19410379906ed109a214b195d705cd5e1c0b97dfb3c557571551449db87812
MD5 b8290ff150411dcabdb0d7945b60f0ce
SHA1 24bb94b3e82c9bde98cadb2bf11a8b97b278dc05
SHA512 bf9b47630b197ce07bb191d42bb845fd6e8b27370e8be775c96d966ffaccba385cecade23d84b770af511de8dd22c8800d851b1dcae15a2bf0ee70ff3958d7dd
SSDEEP 49152:Qoa1taC070duktvmzbjpdkOPV7ScuBU+DT:Qoa1taC0QtYn7ScuBU6
TLSH
T1FE952215F7C5C2B2C0910670A691C3A7A87A3E7C87469D837FC81B7F6D90ED0ABA5607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2308	4F05.tmp

Executes dropped EXE 1 IoCs

pid	Process
2308	4F05.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4F05.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 2308	3820	2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\4F05.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F05.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-10_b8290ff150411dcabdb0d7945b60f0ce_amadey_elex_smoke-loader.exe 3E4C4C73492843172E415018F26F3CDFECC8884E7FE80D9BD8EB1FD7CB78512E76F91D86DB6DEFFFBFC887703EF2B248045E6C9A3F24106F3952D018FEF8007E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4F05.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F05.tmp
Size 1.9MB
SHA256 a5043d1ea6b12ce411c4884a8abf2214f9b24e35f510b3b3193621ea74ecc77e
MD5 f383a3c0b63cebc630f2fd28a07928d9
SHA1 2bcdead1755e1e1cca78c94fd1792c5fbb49d7e4
SHA512 afe17261a21962145f208c2192cfa61061808ffaf3338b1e2c43888938bddba4a56288a1d67e3598e96ffffb69e36b540029c1b1b0ad84fcb85d7c7b055d74f3
SSDEEP 49152:Qoa1taC070dUI95lT4wLKcmvpP8sNJK9bGKZgGc3Bx:Qoa1taC0p04KA6sNobzKhxx
TLSH
T15D952350F7A5C1B2D0800672B9A1C7EAD8653E7DA6815C837FCD0B7F29A0EC06A71797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2308-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3820-0-0x0000000000400000-0x00000000005E6000-memory.dmp