aae306ae82da18d50080db70c8a58ae7ed2251a5c74687f1abdadf1f8dcebc63

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260817-wqka3sfl21
SHA256 aae306ae82da18d50080db70c8a58ae7ed2251a5c74687f1abdadf1f8dcebc63
MD5 cb0e9e51b47fd9e941c5709269c18b72
SHA1 6acca7ad5f07841659b0aee9c759cd3d78f40566
SHA512 9d643bde101c4632eceef6aa159ecbd191612d067f492966dc6c7816278e957174fa46121a5aea2307f24dd76a5505a9d679d6040dd405c7d33e07c6cb6fa866
SSDEEP 98304:emhd1UryehcXkLwmQL4E1/lbV7wQqZUha5jtSyZIUS:elPLwnEE1tb2QbaZtlir
TLSH
T10C56BF05DBE8EF1EC91F03B590B2222657FAD894E783AFD6A951F5B07E82310BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1156	4A04.tmp

Executes dropped EXE 1 IoCs

pid	Process
1156	4A04.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4A04.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 1156	3448	2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\4A04.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A04.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-17_cb0e9e51b47fd9e941c5709269c18b72_amadey_elex_smoke-loader.exe 7E5A85D43457659F96079DA05ED3B72BA4F3DBB88F6B7553EB0CC0DE33F614367D40F8C6C9D578B7DB02DAB3D4FA1FAB9BD6C88F1BF56721CD19452F60455F4F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A04.tmp

Path C:\Users\Admin\AppData\Local\Temp\4A04.tmp
Size 6.0MB
SHA256 8acf7c2abd26807ba62f0767f6312a1623d0ec3a06442e4242ff4ec70508b528
MD5 4f3f52b0ebf23ec097004d203ef2a589
SHA1 9cfbd41f32739df1b68b596374a7b442569f2e01
SHA512 4cf5eda2abc5f3cc9aa1339330eee3ee0618a1690e5cacb2ece377a42b033985ae4d19cbf98d6b261362b310edee276e57198590b7ebaa82103b4e60259ba3cd
SSDEEP 98304:emhd1Uryetrg8Eqi6Jz5slS5CV7wQqZUha5jtSyZIUS:ely8EF6J2lmC2QbaZtlir
TLSH
T12456BF05EBE8EF1EC91F03B590B2222657FAD494E783AFD6A951F5B07E82310BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3448-0-0x0000000000400000-0x0000000000849000-memory.dmp