71b6d3f27785cff527fc95f6574df05772b4d60c683ead48df197c3fe0650898

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260905-krydjsch74
SHA256 71b6d3f27785cff527fc95f6574df05772b4d60c683ead48df197c3fe0650898
MD5 648656a73da2f561f8a01f3012a341d4
SHA1 17ee9cfc81412e285f4ae5af2aa4eedd80d750a1
SHA512 15449e387c163fa4d535149554cb47b54a2df50117d2c1d7b0f3bfaf56870f4674ccd69649c8632c9e0dad075ba41449d4f39a5254edb2c03d1ec480e03be731
SSDEEP 49152:Moa1taC070d35Bah9RIsETB8d5BTvW/RwEW2TG:Moa1taC045BMosEV8dDTvW/1TG
TLSH
T100952390F794C1B2C0911672F291C6E298697EBD97468D43BFC81B2F2DA4EC06E72717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
436	64A1.tmp

Executes dropped EXE 1 IoCs

pid	Process
436	64A1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	64A1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 436	4772	2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\64A1.tmp
  "C:\Users\Admin\AppData\Local\Temp\64A1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-04_648656a73da2f561f8a01f3012a341d4_amadey_elex_smoke-loader.exe 6DB9301E53DA0861794D672A683FFDF94484446169ACBF7935E50D615963AD3E6F7E97174BB8FD7438F650A7520FBE225A08119E00251C1222457734984CD9EE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

64A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\64A1.tmp
Size 1.9MB
SHA256 d26ce97e1b3e195fdf68f2a4f162dedeec78a399986feb57066f6f2e22e6824d
MD5 9282277a2f3ef4df0c8488ea8818162b
SHA1 02b2c1d2390aed5e2e7beaeb2117636656242298
SHA512 461e25ea98e0f0f1af10261adea2402f660f6dd01f2425d10136694cfa49c51e370717ad9680dfdc0f264631c4e4f1d903c0ab6c9305acc6d25a0db7381a22cd
SSDEEP 49152:Moa1taC070dH8TCMh4lyd8DJdHl7afRsh1B02:Moa1taC0I8TCu4lxdSk
TLSH
T153952355F781C1B2D0820A75A9A2C3E29C653D7C5A419C837FCD1F7F68A4EC0AA72B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4772-0-0x0000000000400000-0x00000000005E6000-memory.dmp