480ee9db36150d578046eee80ad31f1bcc8e79d0024a873b451ba4f55c0d624a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe
Size 4.4MB
Sample260817-wydhhawfld
SHA256 480ee9db36150d578046eee80ad31f1bcc8e79d0024a873b451ba4f55c0d624a
MD5 b5a78f124b89c2a7f3e626af95b8ed26
SHA1 0f698b0747f0014f5548ad354a348d3791e60990
SHA512 f514f039f66f26e0fe35e56580a9dd46a58383b65e10cac8f3adf9222ff8216a335705e744d570aa4a715a2acc96e6a32c69de0ee563cdfafe406e89b7105f98
SSDEEP 98304:emhd1UryengrSqOz/77V7wQqZUha5jtSn:elHgr/Ozj72QbaZte
TLSH
T14F26D00995FCDA2CCC1F51F4A1A51145C7F4A524EBD3AF997DA2F1F02A823A0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1296	1A59.tmp

Executes dropped EXE 1 IoCs

pid	Process
1296	1A59.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1A59.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6088 wrote to memory of 1296	6088	2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6088
- C:\Users\Admin\AppData\Local\Temp\1A59.tmp
  "C:\Users\Admin\AppData\Local\Temp\1A59.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-17_b5a78f124b89c2a7f3e626af95b8ed26_amadey_elex_smoke-loader.exe BD17ACFC72BB8C378226F6C49309DA657DBE0ECD58B17218D94DD09DF9D9927B2D135713CA4D40CC93151C74C4880B4BEBCD546BDBC8E02C4784C706157774D1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1A59.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A59.tmp
Size 4.4MB
SHA256 934a21d7090ce35e516abae43d406207dca4277f5543212178278805119defa1
MD5 4cd6a715a6c827adab9d683c03782e0b
SHA1 afc0c7de2c01f5c1193868ae2b28085dc4fa7986
SHA512 5b32f780fc451fe8332d32817444bbcb8ca1d0dc04d8f3f84d88f5dbbc027a415f3104ebf3345645a784960c16039aa8fd6d1bb8dd35d87de8ed5bee9a473b3d
SSDEEP 49152:Svm2AC0d1XqrdryeJVscnNJP4VT2SUjc4i8D+8iwLVT5dVXeQqZUhh4r5VC9PI+l:emhd1UryeIoD4VLUjHV7wQqZUha5jtSn
TLSH
T10426CF0996FCDA2CCC1F51F4A1651145C7F0A564EBD3AF99BDA2F1F02A823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/6088-0-0x0000000000400000-0x0000000000849000-memory.dmp