bfd44028a1fe7dca9d244a5ccc758d39c6f1c9b47bfa031477d11f5d8ec5080e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260810-wpmd2shf76
SHA256 bfd44028a1fe7dca9d244a5ccc758d39c6f1c9b47bfa031477d11f5d8ec5080e
MD5 e7dcdf0cf566cf04025cd635da9ee703
SHA1 5eeca6f763e1be8ed4b2891f97e100f483c9ec39
SHA512 a34375c3519afee74b794f6bfe076b68fff2069d9a80f108eeaf952fa12355e65685bc37e36703c353538829471991e02a3338024bc6d1406eee23052546776b
SSDEEP 49152:foa1tqC070XU/FBkw2a6dn/0JTnlStd3s1S0NkvqlZ:foa1tqC0J/LpAnGnlSru4
TLSH
T158951250F7E581F5E0A75A319AB282A399B63D7857308ECB26C8466F2E32FC05D35713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2636	2258.tmp

Executes dropped EXE 1 IoCs

pid	Process
2636	2258.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2258.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2636	4912	2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\2258.tmp
  "C:\Users\Admin\AppData\Local\Temp\2258.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-10_e7dcdf0cf566cf04025cd635da9ee703_amadey_elex_smoke-loader.exe 758AE74346FB057469756E61D702762743F7139DA693268206141DB7943C89633AD5BE44DA0106383D27904315D7EC0E0F9E5B2C6D7869C55EFD61AD63B560BC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2258.tmp

Path C:\Users\Admin\AppData\Local\Temp\2258.tmp
Size 2.0MB
SHA256 25725d1dae72d9aae13ce70341f4c92e5f7637e7c7a43ff702f5da7e70657a45
MD5 4bb2c6025346ffad87c6437e0c2fa513
SHA1 c355601d4b40af35f7ca67a721e8cf0629fb6544
SHA512 8197ebe1633c965ce1e01288739ee04b7793dfa667949dbbd56b56da0a8166dc2d822396ed741734e8d2680dd16a9f69c72ba04bf4ae3c74b0d6cc9dc1fd9a6e
SSDEEP 49152:foa1tqC070XgJoJ1t9xoe2wcpsXjnijdz+RlZ:foa1tqC0BJoJz+sjniR6
TLSH
T1DC951250B7E181F1E0A25A70AAB283A3D9763D7D57358ECB27C8462F2E61FC05A31717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2636-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x00000000005E6000-memory.dmp