a9949a373f52bee1ebf9c44eb5a7924c9106bcf7f77b8dd1c391bfb45586bf81

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_b6c4790b2bdf124b4ac2561ded81f5d5_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260819-e8gjgadn8w
SHA256 a9949a373f52bee1ebf9c44eb5a7924c9106bcf7f77b8dd1c391bfb45586bf81
MD5 b6c4790b2bdf124b4ac2561ded81f5d5
SHA1 16adc6b69b855f77af9473eeca1a0845c6379075
SHA512 20981b80a324875774b75fee2ce820ed14fec0d2ce47e57dc5078e51b690a5819fcaeff930274995ec3444cd6d7cb28b56dadde086abb1c63e23c48e6d5b0f12
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dubR5DkL7hbLL1QtgIMk3nMZhDWEvf9g7mghq:Qoa1taC070dayL1bvagIC9KxTiQ2F
TLSH
T1A2952200F3C6D1B1C0921A71B6A2C7E2EC693E3D5A424D937FC9163F6A94EC06A72747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
616	4FF0.tmp

Executes dropped EXE 1 IoCs

pid	Process
616	4FF0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_b6c4790b2bdf124b4ac2561ded81f5d5_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4FF0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 616	1676	2026-08-19_b6c4790b2bdf124b4ac2561ded81f5d5_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b6c4790b2bdf124b4ac2561ded81f5d5_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b6c4790b2bdf124b4ac2561ded81f5d5_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\4FF0.tmp
  "C:\Users\Admin\AppData\Local\Temp\4FF0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-19_b6c4790b2bdf124b4ac2561ded81f5d5_amadey_elex_smoke-loader.exe A1A31A98705527B77707E0391ABE14D5D929049D26560A98EEEF656D8DC7C25D13640D26B3B885DA70EC592CB4C379F42C5C243A4581382DA6FEC5417862D8AD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4FF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\4FF0.tmp
Size 1.9MB
SHA256 76d832855e14cbf291398a20bbe66d2621ae709227bf80f7577a787d4f6f5500
MD5 22481a0ef69aafb1349f3c8219e8575a
SHA1 19f8719e312ad5bdee0e1d1bcf7b44e8395991a3
SHA512 202d702572181e105df910bcebb64ec69a9369c8d4cb7fe7a5c6d5adedb9f18cd795fe75ce64f3d036e31a3b5ddd7d26959eeb0d0abe06387daefff515f0c1dc
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dMqRJUOGHU9SUNdNIbEcQX1cZ/kSnmktPCHmq:Qoa1taC070dxTUqsuSHSW2
TLSH
T128952250F799C2B2D0911A74A692C3B3D8763E7C9A408C877FC81F6F1994EC0AA76753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/1676-0-0x0000000000400000-0x00000000005E6000-memory.dmp