4c3f0dd924c5d27eacf0cb8080f65522e7cad470dac8db95448db6417c22a353

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_461c0f20741dbb575c770cd8094544d9_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample261104-11ynnsvxay
SHA256 4c3f0dd924c5d27eacf0cb8080f65522e7cad470dac8db95448db6417c22a353
MD5 461c0f20741dbb575c770cd8094544d9
SHA1 784d33b2741e4d91e2342c2e629b82c540265bf3
SHA512 7f8f510c1181d40562622c8c8263273b4920a5955d2057cd551cfdd3f339243da861123ce9837a56d281bae111fc25f3503cb32ba50f004015a3724b65808cfc
SSDEEP 49152:Qoa1taC070dPNPsdW23/kUw3ot51a4Q19c0PUv9jSQbaGXToDGVfG:Qoa1taC0wPsx/kK3alr+bcGA
TLSH
T1E6952354F785C2B2D0810A31E591C3F6C9653EBD97829D87B7D82E6F1DA0EC06A31B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3672	DFEB.tmp

Executes dropped EXE 1 IoCs

pid	Process
3672	DFEB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_461c0f20741dbb575c770cd8094544d9_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DFEB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3672	4872	2026-11-03_461c0f20741dbb575c770cd8094544d9_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-11-03_461c0f20741dbb575c770cd8094544d9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_461c0f20741dbb575c770cd8094544d9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\DFEB.tmp
  "C:\Users\Admin\AppData\Local\Temp\DFEB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-11-03_461c0f20741dbb575c770cd8094544d9_amadey_elex_smoke-loader.exe 4B86E6F321FD3E65D313CA54FE922CA28809D80BCE5B743A329E49C20B0B43FE89FB41BB927BE993316FDA362A9AF8F1857541E92646711DD91C33927EEC50A6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DFEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\DFEB.tmp
Size 1.9MB
SHA256 6a92106505f8c7cc3cf88f736ea878ca902ebe929ba61d8a220485434d274893
MD5 f0a33a0b769cffb1dd303fc22c0fbf43
SHA1 65b745094606a4e6f7d2a1083d018e7ec6a2ee92
SHA512 15d2d2c8b4e2996385ec096ce84a02fbec6509a7644bae1794830d2fe5ba4e35346a97ad9dcfef34afa1dc9ee9d85cdf53ed6b4c3f13731d7c22d6f2feabeda8
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dMpAU+ONpM0TtzhvO6jH0/QkuTbksir7qlqde:Qoa1taC070dOe0T/Vkf7qlkw+veThp
TLSH
T162952350E795C2B2C4901A71F192C3E2D9663D7C86459E47BFCC1A3F69A0EC06E72B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4872-0-0x0000000000400000-0x00000000005E6000-memory.dmp