72ba1f67896d4e89821d852a787373ac116baceb5af0ca34bb6561d125ec4232

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 19:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader.exe
Size 910KB
Sample260629-ylvmcsd161
SHA256 72ba1f67896d4e89821d852a787373ac116baceb5af0ca34bb6561d125ec4232
MD5 c878ae215e57658a55a93a060aa6feed
SHA1 ec0f461da283781a05883513be2f4a5d5432a208
SHA512 50b99931b87242c096c373b7e099cbdf0f09d60780e052118c0735bdeec048f5e475f46c3aeca81deb1bd4d64d256b7862a6174c7971c6258bc467e9de340d05
SSDEEP 24576:qM6aPsVQGNofMuDarQGhee21TrldFpAtXyXuzgdMVw+hkJ95FA7:VZ+LhkJ9U
TLSH
T1B815D2133501B828FB7012FB27A7464B64A864E44399E5F322972E9EF5437D72BFAC41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	408	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_c878ae215e57658a55a93a060aa6feed_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 380
  2⤵
  - Program crash
  PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 408 -ip 408
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-0-0x0000000000400000-0x00000000004C7000-memory.dmp

Download

memory/408-1-0x0000000000400000-0x00000000004C7000-memory.dmp