ced8be67faeb934162049a650c31456c61122167cabc453c9b35deef333271c0

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_cde2080355c919f333e284209059ce43_amadey_elex_smoke-loader.exe
Size 2.0MB
Sample260804-rfk3eabh95
SHA256 ced8be67faeb934162049a650c31456c61122167cabc453c9b35deef333271c0
MD5 cde2080355c919f333e284209059ce43
SHA1 0b78908912a2f9d55220ec503769e517421e765d
SHA512 47efb239433ce6b862305d8ef0f3352a27f65f689814ce1c54098d3794d2d8d6b549eda686b49b76aca2d938764bb2347716fae7c53e744bfa6573cb604be9a9
SSDEEP 49152:foa1tqC070XS5rIEX7/W7U0rEl37SrTCrSoCL+lz:foa1tqC015rBX7O7UMElWarSoCL
TLSH
T1E4A50100F3D68075F4B25A3099B282529D763C385BF1CACB2EB8DA5E1E71EC19935727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4868	1AF5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4868	1AF5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_cde2080355c919f333e284209059ce43_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1AF5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4868	552	2026-08-04_cde2080355c919f333e284209059ce43_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-04_cde2080355c919f333e284209059ce43_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_cde2080355c919f333e284209059ce43_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\1AF5.tmp
  "C:\Users\Admin\AppData\Local\Temp\1AF5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_cde2080355c919f333e284209059ce43_amadey_elex_smoke-loader.exe B10165F525344F20787C279AABFDFE32BEE80E83AEAC611C2494C483DF2647BCFDB1B62426C7C41A3F92884F85BF02D53E8CCBA8FE33A8E7B6F14A09AD29DAA9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1AF5.tmp

Path C:\Users\Admin\AppData\Local\Temp\1AF5.tmp
Size 2.0MB
SHA256 2122175ad0e5adc34bc6149661f7a210f9e2b42591dccf00eab697079abaec18
MD5 f451e06ab3a9c5c8410ae7d5bd85312d
SHA1 d63a0c79c7e10111b7ad982239292385a23f8e40
SHA512 17f8d56f001e260e5aec05b65c62a81bd2aa6ad885e8aa1079cd0cb17950431a04f809f2b34a864087edbbc105bb4c3b7a2e3fd47bd5af0fcc778218927256ca
SSDEEP 49152:foa1tqC070XXJT+n7joodUHIbmxMw99nkueqWPPlz:foa1tqC0SA7soMIbmP99nkueqM
TLSH
T107A50201B3E68174E4B21A31A9B182515DB73C7817F199CB2EB8D65F2E71EC09D72B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4868-5-0x0000000000400000-0x00000000005E6000-memory.dmp