cfe40ff0d84c6da35cf375f0d823ca69d8784b4e01578fa1471d3a7794c8f357

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_cfeb334c2bfd8aede95de9af3cbf6391_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260718-ce4e2acw8n
SHA256 cfe40ff0d84c6da35cf375f0d823ca69d8784b4e01578fa1471d3a7794c8f357
MD5 cfeb334c2bfd8aede95de9af3cbf6391
SHA1 463f55d770e9479f85a8a1cda6eef15e2ffb59b3
SHA512 88b77652b382f117fdef31986922aa3c0ca799cf3c580fe759b854b0ffcd205f6321a7f0b79d765009294946d3e2553d0e770c70bc724a4529c78c7a6b0003da
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dsDkwvh2w04n5jnrwBTlM5K163Y/jv7qCqYs6:Qoa1taC070dsrn5jnrwJhzqLYsCVdZ
TLSH
T182952321FB95D1B2D0810A31E162C3E6D87A7E7E46059D87BBCC1B2F2864FC46762B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
540	1C0F.tmp

Executes dropped EXE 1 IoCs

pid	Process
540	1C0F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_cfeb334c2bfd8aede95de9af3cbf6391_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1C0F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 540	4328	2026-07-17_cfeb334c2bfd8aede95de9af3cbf6391_amadey_elex_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-17_cfeb334c2bfd8aede95de9af3cbf6391_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_cfeb334c2bfd8aede95de9af3cbf6391_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\AppData\Local\Temp\1C0F.tmp
  "C:\Users\Admin\AppData\Local\Temp\1C0F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_cfeb334c2bfd8aede95de9af3cbf6391_amadey_elex_smoke-loader.exe BA54154B292B51108065A2AF54C217BBB0073D0DF9DFD23D9B586655D365A58877CD9FE29F4107D5401DB58D7936396E9F32A5D548F6AF0E5E079D3F08023A3A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1C0F.tmp

Path C:\Users\Admin\AppData\Local\Temp\1C0F.tmp
Size 1.9MB
SHA256 68626577c909ce857c46ccb7052043d9b9ba2d79692429d7b64a847c2d2511f0
MD5 e76f3a360dc6c2ddf07ccef9ba1496b8
SHA1 1bc134f08f15eeded1b142e88860b7045d106748
SHA512 4a39e28df42b9df7e011e97ffc124adf56efb27e9fe6011b77ef2da61c0948cda9f0049bf2dc5a801731b5cb5bf6ae3490ed1855eb1dc41730b1a03dbad497f1
SSDEEP 49152:Qoa1taC070det72tQLjOwjIDi0M0pGqGEYf:Qoa1taC0HKmLCwYpMCGqGEc
TLSH
T109952314F391C2B2C0911575AA61C7A2EC753EBC96058DC37BCA1B7F1DA8FC06A22B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4328-0-0x0000000000400000-0x00000000005E6000-memory.dmp