844179d56d0c66d1e47a28065ce265821ca757530f8f1f8036b97f793904ec42

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_5de316d0dce5dd1edff8f7ebeb76a37e_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260905-ljerxayvbw
SHA256 844179d56d0c66d1e47a28065ce265821ca757530f8f1f8036b97f793904ec42
MD5 5de316d0dce5dd1edff8f7ebeb76a37e
SHA1 cd60412572b691bfddf22d6d61c5c395c7706048
SHA512 760e551607a7ad80b4077ee42de54de57170e6e948ffd9b92b20f43e3c5eac9ba723052e0a9c07dce13c443408dc018863097b097713612300747c1bcdde76fd
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dZoomX083enhIhsoJkFx43eX9KQlEfgdLGtXm:Qoa1taC070daHX0B+U5XIQLLGEum
TLSH
T1E7952204F7A4C2B2C1910A75A592C3E298A53DBD57419C87BFCC1B7F1CA0EC49AA6B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4500	2834.tmp

Executes dropped EXE 1 IoCs

pid	Process
4500	2834.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_5de316d0dce5dd1edff8f7ebeb76a37e_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2834.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4500	3028	2026-09-04_5de316d0dce5dd1edff8f7ebeb76a37e_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-09-04_5de316d0dce5dd1edff8f7ebeb76a37e_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_5de316d0dce5dd1edff8f7ebeb76a37e_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\2834.tmp
  "C:\Users\Admin\AppData\Local\Temp\2834.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-04_5de316d0dce5dd1edff8f7ebeb76a37e_amadey_elex_smoke-loader.exe 0ACDBA12325BE584F4B64B3F8954F51228E26C6F2AD1B31E751855E10CF2E54136E23A7A921258134BDE873CDEC11CE36014CF86C6DF16F02B1FFE578CD7A118
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2834.tmp

Path C:\Users\Admin\AppData\Local\Temp\2834.tmp
Size 1.9MB
SHA256 eb636669567e2f31eacddabd269ff96aaa21db154bd4f20ed13a5986fbf2677d
MD5 0419f624c4ca59758f8eb65d15912917
SHA1 31b2b9583d84d09b9b2b1c08a469cfb05fd54f74
SHA512 a89bd7aba8b8b3c5c7846c6f2156c42c3f86bf022132aa4854c766938fb53e6072874f6ae492a8a8b68c23b4cc0150855a8bb4d77fed59b82f8c61cd8fca896f
SSDEEP 49152:Qoa1taC070dLwonHFtG9uIFMJqb5y6ChNXOsIxeh:Qoa1taC06tGcqbMdhAsGeh
TLSH
T176952361F3A5D2B2C0811571A591C7FA8C763E7886458D837BCC16BF68A0FC4ABB1B47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3028-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4500-5-0x0000000000400000-0x00000000005E6000-memory.dmp