c339cc5d50383f352ecea8d8021d8389f237f2b60942bfb1fca02d815396925b

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260822-pbp5fstfnd
SHA256 c339cc5d50383f352ecea8d8021d8389f237f2b60942bfb1fca02d815396925b
MD5 7b1205b2a7d59f775718a873d45edc49
SHA1 920f02872d9af4b8310f32330e9ce844b953c6e0
SHA512 34ed942334955e0f5b962bb2e0083d1ad56f2af5e4f7fa47aa5aa409b8bdd6dcac9ae071a37bbea45cbb86ba40c0ff8e9ede55a1e763782b4a449a4b64a5df4c
SSDEEP 49152:Joa1tHC070Ubk497nVa8dWHWBbrc5NqMd/ChgyvFICUan:Joa1tHC05lnVM5NqQCWxCHn
TLSH
T1E2952200F790C2B6C0915A35E662C7B7E9793D789A408C87BBCD5B2E2DA5ED07A31743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1060	D76F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1060	D76F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D76F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 1060	1732	2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Users\Admin\AppData\Local\Temp\D76F.tmp
  "C:\Users\Admin\AppData\Local\Temp\D76F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-21_7b1205b2a7d59f775718a873d45edc49_amadey_elex_smoke-loader.exe 1216B184F005F45C40CD72F734FA5070DC35AC5EFD72BF0A0F93D7EBF5ABD6307037BA8279E135CDE40A77339435F3116FF3FF8774EB7547ACFD8D4FF1E128F9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D76F.tmp

Path C:\Users\Admin\AppData\Local\Temp\D76F.tmp
Size 1.9MB
SHA256 b8dfef1b7f4c162cfd6ac4e35f1c895de7e238d563ef47024df0442eac33d469
MD5 0f2d7ed7c22b5197ca5eeacd3a18ab63
SHA1 a2297786d5bf7e042cb3bb3eef3172c87b86d862
SHA512 bc3d81bec5980659a3d86875e13e4df3fd619f8fa7b5e35467b00b783705fae51b3a0dba663fdfe4f3901287ac509c58cb54fe462452e03250ed49dd6154c72c
SSDEEP 49152:Joa1tHC070U9Bu8lKJbo3t9yXZJD8Nroxmmz6zptkso:Joa1tHC0D4ZJoowNoxLzMtkv
TLSH
T17D952350F791C2B2C0824971E5A1C3A7DCBA3E7987568C837FC91B2E2D64EC1663275B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/1732-0-0x0000000000400000-0x00000000005E6000-memory.dmp