b313699c4274e144bc69dfb0a94e831b53fca3d1433b0e37dccba5818f01d9ea

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260820-3dptcsxcph
SHA256 b313699c4274e144bc69dfb0a94e831b53fca3d1433b0e37dccba5818f01d9ea
MD5 c4b37948129635d4eaa3b9a2d1cc8717
SHA1 8bfc2e849594f077381945ff9f0e7a2b3b93e477
SHA512 b1fc35bc70f58d9675fa5b8e8384924062829fe7a63aee1b275b209f7d94fba02f3b81604194fa72e0775c2eb7482039394534067c76e1f67f028f918236c956
SSDEEP 49152:Qoa1taC070dCkK/9KOfc5Seja4koiEaqocsbpG3w5k:Qoa1taC04eenslsoceWwK
TLSH
T1DC9522A0F791C2F5C0800671A1A6C2A6EC792EBC57914C833BCD6B7F5DA4EC17A32657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3500	84AC.tmp

Executes dropped EXE 1 IoCs

pid	Process
3500	84AC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84AC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3500	3508	2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\Temp\84AC.tmp
  "C:\Users\Admin\AppData\Local\Temp\84AC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-20_c4b37948129635d4eaa3b9a2d1cc8717_amadey_elex_smoke-loader.exe 0BDF981F819DC09C4421410F94AB7ABD80FFAC18993C9BC9806277098E6984225E23993532EB46A2155BC168F2BEB96C8419C31205416399CE6BF760D126835C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

84AC.tmp

Path C:\Users\Admin\AppData\Local\Temp\84AC.tmp
Size 1.9MB
SHA256 7413c57e4af918c5f5aa99f0cb8600637a51d7d57f763caf872bc1efd9d8d895
MD5 5a4fe9d8c4fbfdc04cae7d9e53472808
SHA1 2eecb61d34722f45dcc092e3571039e4fa4c335a
SHA512 f911f4d2e9820a926a6e808b6a2f770572496344e9474cdf576d8a498b7e00f6fa854b4afce3d6bd339a78173d7cf16cd9fbbbf451a02622e9c2e319ef47bb62
SSDEEP 49152:Qoa1taC070dnxM48AzlUm+81kLsXRtcREa2vseKx0d:Qoa1taC0UM48AhUJ+RtcRH21e0d
TLSH
T1BF952250F394C2B6D48105B1A652C7A3D8763EBD57868D43BFCC1B7E28A0EC0AA72757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3500-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3508-0-0x0000000000400000-0x00000000005E6000-memory.dmp