26dfaffcad5d5c88f43f2908570ccf75d5a1a9b541206fd21c6c1e54777e947c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_f5aa2f46d3cd8147d4bb938dde49eac7_amadey_elex_smoke-loader.exe
Size 6.5MB
Sample260802-tlxphacm2s
SHA256 26dfaffcad5d5c88f43f2908570ccf75d5a1a9b541206fd21c6c1e54777e947c
MD5 f5aa2f46d3cd8147d4bb938dde49eac7
SHA1 68767c86f03d7541e35e7b5c02e22f634794da0a
SHA512 e4d653045f5b46222e014b61c305c49bd5542e925f96cb440434ccc9a96681b98473f8442fc4b0da6ac2ad0e654280c52903158eb30e9dee206e2410390fdb46
SSDEEP 49152:Doa1taC070Uh5ygmSjvYyxbZ1UTL7SwefADPMlhdB:Doa1taC0H3pbzVsKB20XdB
TLSH
T1F366CC00956AF3618A802831997EB259C4E4ADA493FD48F33D8D3AF9D773BE37532245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4252	ACB6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4252	ACB6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_f5aa2f46d3cd8147d4bb938dde49eac7_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ACB6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4252	4856	2026-08-02_f5aa2f46d3cd8147d4bb938dde49eac7_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-02_f5aa2f46d3cd8147d4bb938dde49eac7_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f5aa2f46d3cd8147d4bb938dde49eac7_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Users\Admin\AppData\Local\Temp\ACB6.tmp
  "C:\Users\Admin\AppData\Local\Temp\ACB6.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-02_f5aa2f46d3cd8147d4bb938dde49eac7_amadey_elex_smoke-loader.exe B6C3E0BA5C6DDE39663991F38F937E4381851B4047DFA43F28E561033A5508F9B6193A2AE56E1B00E854F9D894291C2A804D94BF40433ABFD8482059835B2A8F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACB6.tmp

Path C:\Users\Admin\AppData\Local\Temp\ACB6.tmp
Size 6.5MB
SHA256 12d77f87a1fe9fed19d8c2c57291e3ea2002e8ebca7cd26b2ea53af217c1dd80
MD5 512322a66a4442bcb817d1038bc2133d
SHA1 3599c75d7f10bcaba43dfad3c04a9045c6f711de
SHA512 997859a5bffef75be3c24dac96289265e8d8c1a9847d54dfecb2efc5ac9f92dee0cc5c04b96c4c14afdacfb6284fa1eedc71df57a2b9c85b9155f216dae6ed30
SSDEEP 24576:62oo60HPdt+1CRiY2eOBvcj3u10U7Aggzo5NkonZ/CEbNL2mAzZN+R/unBbyTMXj:Doa1taC070UklzsKI/pbNL3mZ8mbnT
TLSH
T12466BC10916AF3618A802970997EB659C4E0ADA493FC48F37D8C3AF9D773BE37532605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4252-5-0x0000000000400000-0x00000000005EB000-memory.dmp

Download

memory/4856-0-0x0000000000400000-0x00000000005EB000-memory.dmp