c9ad6e73560d6885f2b93db903224c1ec0b0fb9129609ee3f7afa37088dcf9c5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260707-cfehasfx61
SHA256 c9ad6e73560d6885f2b93db903224c1ec0b0fb9129609ee3f7afa37088dcf9c5
MD5 9ca5f5c24cc16063ac7a250b2f0c4d3c
SHA1 631282d6b723c640d158eb78ed7790dcd9359f10
SHA512 91fa9a17a71632c821f3f3b44570bb44843a65e309d14301f0496c78d8d849c705774db63fa53b4f8de26bb0ccd00410048c7c1c388dd187c57d344f3481aebd
SSDEEP 49152:Eoa1taC070UKJdJkSS+Y0i1HFAuU6lLmebMU/n6Yf9xgqFqvOJFIp:Eoa1taC0edJkifEHFEKDbMU/ff9K
TLSH
T1DAA50201B754B0F2C5541AB0A455CBD3A661787BBB019DC36E84635F4CABBC8AF63F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4708	35B1.tmp

Executes dropped EXE 1 IoCs

pid	Process
4708	35B1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35B1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4708	4460	2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\35B1.tmp
  "C:\Users\Admin\AppData\Local\Temp\35B1.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_9ca5f5c24cc16063ac7a250b2f0c4d3c_amadey_elex_smoke-loader.exe D5A35C601B28AA28083AB656702E6C9A389B1F628DE4CB320A05B42FB7B508EF99A55F25005CC058D2236BE5F220355CF0586D5DEDC3C187DB2213239FE7FA92
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\35B1.tmp
Size 2.0MB
SHA256 2a9eb4b437932b6c9c2f79cd06e38c76e85f60dd7f899487b63333eaf9ec6028
MD5 ba3ec55fd181d189a2b98fb66f94d168
SHA1 dd4226d8fd7b81e1ace012afc093861ca9bfee04
SHA512 6ea9fb386a153041f502077bb0dc9ba108b76e3790495c6e83a3f660158bca0af5f7a0e380047db17aae7196ac234b7631a9a5e6511bcd164decbd7e2206d7b8
SSDEEP 49152:Eoa1taC070UOfO/hCbAVF0olqy4GRjFIROmbUZeqvOJFIp:Eoa1taC0YfshPfpzjFQOmbUZV
TLSH
T1CEA51211BB05B0F2C6155AB0A995C7E3A6216CBB7B418DC73AC4139F4C96BC89F13F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download