fc6b99cf8a0de826b6da38655f06eaec487acabc9d691912c7db0e7473e71f74

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_215cc9ae040caf10ae81550f450de1f4_amadey_elex_smoke-loader.exe
Size 2.1MB
Sample260804-drdkta1cpe
SHA256 fc6b99cf8a0de826b6da38655f06eaec487acabc9d691912c7db0e7473e71f74
MD5 215cc9ae040caf10ae81550f450de1f4
SHA1 3c7fddd20f5f127518aec06b7dc892f5c233699d
SHA512 945a1a4bb3a0596be8acf2d6a5692b002588c0706aead886731095604ffc57719de4a07a6f452cee99cddf591f2ed3a0b288e826fad634fc774fe1bb749d215b
SSDEEP 49152:Hoa1taC070UQtOwOHA3MAVy5a4UCeppO9THt7yf:Hoa1taC0+tFSUCeoTHt7yf
TLSH
T117A51205B629E1F3D1614770B865C6E2A6776CB4BF414EC37AC4131F1CA2BC89EA7B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
632	6C13.tmp

Executes dropped EXE 1 IoCs

pid	Process
632	6C13.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_215cc9ae040caf10ae81550f450de1f4_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6C13.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 632	2060	2026-08-03_215cc9ae040caf10ae81550f450de1f4_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-03_215cc9ae040caf10ae81550f450de1f4_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_215cc9ae040caf10ae81550f450de1f4_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\6C13.tmp
  "C:\Users\Admin\AppData\Local\Temp\6C13.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_215cc9ae040caf10ae81550f450de1f4_amadey_elex_smoke-loader.exe 0A6432FEECA4818D108591CBFD07031BC40EDE6E6BF70BF621FFA3A04DC119B5FF6588C56F86AD19DFA0ADA878B0791E72480981B289799390714745F4EC637D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6C13.tmp

Path C:\Users\Admin\AppData\Local\Temp\6C13.tmp
Size 2.1MB
SHA256 2f986c4a7bc1fdf22e151ff34e23ed1202f9f3da8da1c1d68fad0f58a8ac9970
MD5 6321fbdcedb1ac6afa2e588626c601b3
SHA1 c19c60481bc57c5d59692c984e3cc5a8b1171cb6
SHA512 eb773f5eee97b866327686b1a5cf75708c943282c4f02825551057ece5375eb0baa075430e265c99ce2d2284320e0a6b45a372e386c4640a4a8c7c16881f0a98
SSDEEP 49152:Hoa1taC070UFoxcJPWgaLBoSCykq3LKm6+stnKYxdgf:Hoa1taC0MuxWgaL6SCykqWV+inKwdgf
TLSH
T180A51206B659F0F3D5614770B851C6E29A762CB4BF414EC37EC8635E0C627C8AEA7B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download