6e43a2066264ccdd8657394ad23a7691b10fb165f3b5cf3b619867940e4f1b58

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260802-jtkpssfd32
SHA256 6e43a2066264ccdd8657394ad23a7691b10fb165f3b5cf3b619867940e4f1b58
MD5 ce8ec76f4bfedb870655bca52dd66ba3
SHA1 6a3633e5d619a40881a406c8dc255cecc7030840
SHA512 6c074a582252a4a09d55d9fde6acda4fa21bd19a47a09c2b34f44adc15b910b91975a667dfe750078ca9ae0e2215efcb854023c8f9de7e551a9ca42034f25228
SSDEEP 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dXz9hChnErFsb3KvDQeZpJWX4fSD/GSV9I8bA:Qoa1taC070dzmErFK6/ZiX9ICYq2q0
TLSH
T1EF952341F3D4C2B2C0804671AA62C3E2E8B93E7D56859C47BFC81B3F6960EC45A76B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3864	76B2.tmp

Executes dropped EXE 1 IoCs

pid	Process
3864	76B2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76B2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 3864	3940	2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Users\Admin\AppData\Local\Temp\76B2.tmp
  "C:\Users\Admin\AppData\Local\Temp\76B2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_ce8ec76f4bfedb870655bca52dd66ba3_amadey_elex_smoke-loader.exe C6EBC026556061FC89DE49F6BEFBF767F8AFA0756C64474CAD0A12F0973D2CAFAB2E2C8C0C683873D5DC28B742F5D5187E1B0A50FCC8B03EA2DD9C08FBC5E844
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

76B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\76B2.tmp
Size 1.9MB
SHA256 b4aec758945197ab479eff2473c325b63b68d31a48b741db028b5da481fedaae
MD5 25871682378faa3805cdbfa0753ffc20
SHA1 d55e95a1bbb8407673227cb15df2c2d0310bd35d
SHA512 e818f36734f1e78153b158fdead23599d86f1e8e559946c26ea0278be7f66d85c6f11ce9a2274425d2184b66f9d193f86a6d156d3116b3252c614ecccab56528
SSDEEP 49152:Qoa1taC070d++Swwk2bmlv0gbN9vYFTxcC8C62c:Qoa1taC0sw0xVYIPC6l
TLSH
T1E5952250F791C1B2D0811671A161C3F6EC787D7E66859C837BC91B3E2A60EC47AB2B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3864-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3940-0-0x0000000000400000-0x00000000005E6000-memory.dmp