707db77c0d32f7e66b2c924b7fa187fdaf914037428891274268ee803286fcdf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 13:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_4245a8a74023cf3b55b27c88fe3bee85_amadey_elex_smoke-loader.exe
Size 4.3MB
Sample260723-q7wsjsbc83
SHA256 707db77c0d32f7e66b2c924b7fa187fdaf914037428891274268ee803286fcdf
MD5 4245a8a74023cf3b55b27c88fe3bee85
SHA1 d9a8af20d0a5ac4dcf01a42090252756f4d2dfff
SHA512 274eff8b1c8fb145a19f12661beb5206cddfe29a1cfc433f72c4138276a22a151fab9622dbdcfb74ac6b255af1a0eedfc3efaee56f4a40b9dd39ec1da968106b
SSDEEP 98304:emhd1Urye4XCccK40YM4tV7wQqZUha5jtV:elAcK4nMc2QbaZtV
TLSH
T14926CF0896FCD92DDC2F52F4A1641185C7F4A564EBD3AF997DA2F1F029823A0B987073
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3252	C2FD.tmp

Executes dropped EXE 1 IoCs

pid	Process
3252	C2FD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_4245a8a74023cf3b55b27c88fe3bee85_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C2FD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3252	2724	2026-07-23_4245a8a74023cf3b55b27c88fe3bee85_amadey_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-23_4245a8a74023cf3b55b27c88fe3bee85_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_4245a8a74023cf3b55b27c88fe3bee85_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\C2FD.tmp
  "C:\Users\Admin\AppData\Local\Temp\C2FD.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-23_4245a8a74023cf3b55b27c88fe3bee85_amadey_elex_smoke-loader.exe 6D87A38FC4CE4E6881866873E045FFE87943174B0106043D68B612261E2D3C9B48B28642398EA58F2159F8E3D255BB12D34CEEDB6E8DCFFB3D4AB6509066B8F1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C2FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\C2FD.tmp
Size 4.3MB
SHA256 b7b8fe625864ec4680f4f34a427ea2e697ba2a752776a9875b3827f5991b7c70
MD5 0f2fc3d80e3d723e257f2fc91a35e8df
SHA1 bd8adac180913a9ad18bf9342d835189bc5eefc6
SHA512 d5f2e94a2e8470cc642291317b730f68365c04a170ba64bdf3cb66b7a2f570b1c060e004fd1df89b9a6e556247d3ca2cae95b1c63919f7c21d1a350cb1bf30d5
SSDEEP 49152:Svm2AC0d1XqrdryeJVVlyjge0d/H1GpvtXbnYbwLVT5dVXeQqZUhh4r5VC9PI+Kv:emhd1Uryeh8jsJ0tpj9V7wQqZUha5jtV
TLSH
T17F26CF0896FCD92DD82F52F4A1641185C7F0A564EBD3AF997DA2F1F029823B0B987173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2724-0-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/3252-5-0x0000000000400000-0x0000000000849000-memory.dmp