8c37de79bb7d7739e42115bff82136ec8ea29b07183469630bf100037f70fc3c

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 00:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_9b3b0eb02d2fcc77954c4f28403b2537_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260816-ahe6hawzhs
SHA256 8c37de79bb7d7739e42115bff82136ec8ea29b07183469630bf100037f70fc3c
MD5 9b3b0eb02d2fcc77954c4f28403b2537
SHA1 9a18b3c5f8889a99aaac0b0d8d76d8c6277aa43f
SHA512 24f2e7d518465e93d8ce827f3471f8e811191acf006fb515c2e6aed43f9aba46fb0f0ab9c450727bf958c3f0584e0e14a29cd97543988b2eb63f7dbae20224d7
SSDEEP 49152:foa1tqC070XaWQuRVTcL0FspaLKBzW8UlY+vlZ:foa1tqC0P+RY00dlWj
TLSH
T175952350E7E181F1E0A25530A5B283A6ADB63C794735CECB67C84A6F2E61FC09E35713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3848	58AA.tmp

Executes dropped EXE 1 IoCs

pid	Process
3848	58AA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58AA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_9b3b0eb02d2fcc77954c4f28403b2537_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3848	3036	2026-08-15_9b3b0eb02d2fcc77954c4f28403b2537_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-15_9b3b0eb02d2fcc77954c4f28403b2537_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_9b3b0eb02d2fcc77954c4f28403b2537_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\58AA.tmp
  "C:\Users\Admin\AppData\Local\Temp\58AA.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-15_9b3b0eb02d2fcc77954c4f28403b2537_amadey_elex_smoke-loader.exe F3C4200D36BC066969118DB2C7E03A2298D19BCC76C9828C4189E85BE3D9F9109C6F635262819943441098CAB4BFD33807E3CC9439E8140CD9F085D4BA155A69
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

58AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\58AA.tmp
Size 2.0MB
SHA256 f96b5d9fd795ea0bc1c152460a3565b40128a5bc9d6daadf74e8347fe7d9aed4
MD5 f89cf1d708eedaa28f20374cae9ca702
SHA1 c6bf8e5515808c68367920b22d028eb36dac66c1
SHA512 fb971b18438dafe6254c272a5c5c5caa763c2aeaa6141fbfa143c79c710bc8e3b42a9e70f8070b57f0b0199bc1ce7a16607aaf1c5a7f813d3878ecce574e0afc
SSDEEP 49152:foa1tqC070XFXU6bplZuCNc7i/DFWQNLi3lZ:foa1tqC0QlXuwN/DFWQZi
TLSH
T101951211E3E581F0E0A65631A6B282A699B77D785730CECB2AC8472F1E36FD09D31717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3036-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3848-5-0x0000000000400000-0x00000000005E6000-memory.dmp