ff5abdec4d175de4c2af3378dabd323652507b10dfe821826b30fdc6a104dac4

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260818-2wtplasckd
SHA256 ff5abdec4d175de4c2af3378dabd323652507b10dfe821826b30fdc6a104dac4
MD5 d396f7f39233aeebedce7947a6113149
SHA1 952aed19eae608c9ec0e4ce8649d592bd532d1e7
SHA512 a50b96dca18c8df1df754d6cec9313c8197da5e5a732bcd0343b1947c36d823b17fcde3dabb3c91116d7b91ade415a6cd3b023a0e3027cc284a591089ac400dd
SSDEEP 49152:+oa1taC070U71DbLy5Z2y45lv/LjfkeR6E+P:+oa1taC03uE5lvPvRgP
TLSH
T1FE66BC01956AF3618A802970987EB159D4E4ADA483FD48F33D8C3AF9D773BE33532646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2872	6D5B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2872	6D5B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6D5B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 2872	4484	2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Temp\6D5B.tmp
  "C:\Users\Admin\AppData\Local\Temp\6D5B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-18_d396f7f39233aeebedce7947a6113149_amadey_elex_smoke-loader.exe D580D539038D652652C0222A0E86AA24F8EA32DC534D6D49C34AB0D7078C3E45381CEE6DF22E3101F128610DBF15EE7C73AA3BB52F447DD7D0EBA71B009D516A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6D5B.tmp

Path C:\Users\Admin\AppData\Local\Temp\6D5B.tmp
Size 6.5MB
SHA256 03ffd5c4854435af933e5d8935ddeaf56f90224e9c4fcd39c03a7b7e86570278
MD5 e4c244972444ffe69eb7b01e2215f4ba
SHA1 9fc8be975c698294d7f73995c02b143113d6c542
SHA512 2ac7b00fca6edf0d91a9b1c7c6a29f24f19f7908ae7d61af494c19e2b2771e503e3c7cb7454c4d38f34c529e6e4947e68ac23d39786541edfeba86a137a8cc0d
SSDEEP 49152:+oa1taC070Unv1NrDd0hEkZrr/+XnAHHbBWY:+oa1taC0NrpsEkdr/+XAH7L
TLSH
T1B466CD00956AF3618A812970997EB259D4E4ACA483FD49F37D8C3AF9D773BE33432641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2872-5-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4484-0-0x0000000000400000-0x00000000005EB000-memory.dmp