cb72a26ffde286e171299d5ac508d139a05632cde17a5c50ea9964747f801c8f

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/04/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_179f232b8caa49370ad4a83c5c501b51_amadey_elex_smoke-loader.exe
Size 254KB
Sample260426-e32mfsfw3p
SHA256 cb72a26ffde286e171299d5ac508d139a05632cde17a5c50ea9964747f801c8f
MD5 179f232b8caa49370ad4a83c5c501b51
SHA1 da396bca8978d189fee504d2bc857d2d4933f53c
SHA512 3a45a9006eb2dc71b3e9f014c8ce6cdcdc2fdc3f012c3b6440870b864d32d58512d7ec83d3aba602115557e44f18109c7c665dbd68c571a8255fa417f24bd86f
SSDEEP 6144:WhucpMNgU7hCwhZ1ZtQrHqF7WmWinBEujGA69PTBmmduC27uXiS:WQcpHogwb1ZYCnBE0Gl9PT92S
TLSH
T1D5448D10B6A0D532E4A2113689FADBB9196EB471133951CB73C52F7E6D703E2763438B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
924	4892	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_179f232b8caa49370ad4a83c5c501b51_amadey_elex_smoke-loader.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4892	2026-04-26_179f232b8caa49370ad4a83c5c501b51_amadey_elex_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-26_179f232b8caa49370ad4a83c5c501b51_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_179f232b8caa49370ad4a83c5c501b51_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 516
  2⤵
  - Program crash
  PID:924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4892 -ip 4892
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4892-0-0x0000000002BD0000-0x0000000002C2F000-memory.dmp

Download