b918f32153a39e1f2cd483c8dca82ac3a5b87c688e6cf57d67cb130ad29163ea

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c1ddbfb04e8635b71afe07922e76ff2d_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260819-pystvsvalc
SHA256 b918f32153a39e1f2cd483c8dca82ac3a5b87c688e6cf57d67cb130ad29163ea
MD5 c1ddbfb04e8635b71afe07922e76ff2d
SHA1 25df2445b559efae0697f25895648d347444cf6a
SHA512 f646cbe4039b151b81a277c3043fb13029f49be9f5ecd6030f26bbb0d878961d2326efc4fe7a6cebf589fae9100d37624f2e37a005fe02c672e340edf4f55be6
SSDEEP 49152:Qoa1taC070dCp6lf8SwRq/4W35ciYjCEPZ:Qoa1taC0Dp6p8zqQCsCEPZ
TLSH
T149952250FBD5C2B2C0820631F5A1C3F698A57EBE57459C837FD81B6F28A4EC4262275B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6120	9B8F.tmp

Executes dropped EXE 1 IoCs

pid	Process
6120	9B8F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c1ddbfb04e8635b71afe07922e76ff2d_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9B8F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 6120	4748	2026-08-19_c1ddbfb04e8635b71afe07922e76ff2d_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c1ddbfb04e8635b71afe07922e76ff2d_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c1ddbfb04e8635b71afe07922e76ff2d_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\9B8F.tmp
  "C:\Users\Admin\AppData\Local\Temp\9B8F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-19_c1ddbfb04e8635b71afe07922e76ff2d_amadey_elex_smoke-loader.exe 498CC90D80345844611E00F1AC73EAD0A68D266E8221AF38F53F2B36E3191E68476F10E44DD9419D9ECD763953F6C0436926C38977867B1F91132C6598A83ACB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9B8F.tmp

Path C:\Users\Admin\AppData\Local\Temp\9B8F.tmp
Size 1.9MB
SHA256 892dfb442913997cd88a7e9e79831ccf06129bfea575d1fd86fd79a2f1507e83
MD5 dccf035715d92b08eb930e97646f499c
SHA1 e8f5a274b5a7480c100584d8f9d6bc763a57b5a8
SHA512 069b3f765af2f8ac25060aca7c08e418d039998cada72276927f173ff74ca6b2427afaf31722a65423156ef650afc9cf80b5419ed18cd95527c87f72363f199d
SSDEEP 49152:Qoa1taC070dc63eK88yysW75h/44LhxWToy/nK1PvTvo:Qoa1taC0nOpAs5h4M2nKprvo
TLSH
T111952240FB95C2B2C0910671A592C3E6EC653E7D16468DC77BCC0B7F2960ED0AA72B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4748-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/6120-5-0x0000000000400000-0x00000000005E6000-memory.dmp