72c34ee5c2d7b7b53907b6dce70f78a0424071aa456353a660bb4c690c4ac7cd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe
Size 6.0MB
Sample260804-vz8vcsec87
SHA256 72c34ee5c2d7b7b53907b6dce70f78a0424071aa456353a660bb4c690c4ac7cd
MD5 f91b2028dfe725e09dc1c9327fcd2359
SHA1 688120f7f25cc7eb060528ae2b5d5c7f40c99dd9
SHA512 dc6c3de594a0c27ca90d36569a8de8cc75a60992abc05454722a26d924a368664d9fe982d3d19109b2ab20ea0c6af9413fff3545789e35546fda9cae0595814b
SSDEEP 98304:emhd1UryePrvKKTin+8Vy9OV7wQqZUha5jtSyZIUS:eljKFHVy9O2QbaZtlir
TLSH
T1C056BF05EBE8EF1EC91F03B590B2221657FAD894DB83AFD6A951F5B07E82310BD42153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
868	7CEB.tmp

Executes dropped EXE 1 IoCs

pid	Process
868	7CEB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7CEB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 868	1680	2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\7CEB.tmp
  "C:\Users\Admin\AppData\Local\Temp\7CEB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_f91b2028dfe725e09dc1c9327fcd2359_amadey_elex_smoke-loader.exe 4A614C0529A6B93F12A501DB4A2705396BB2D5442534DF0024D2B59A4DA8DE48290FF17DAF4F5D41746083AE3DFCF06C629E4E98C8376039DC9AA96A92C2EED9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7CEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\7CEB.tmp
Size 6.0MB
SHA256 d70d823f767c66307822e6c8e1a88ae30e6697fe207a9d6300630d70e14d8706
MD5 ff4c33fb33819e90d66a0ddde96cfe79
SHA1 4c22d48a4e3c07433a39b526dd5142436ed75ee3
SHA512 456616b6e085741a466dd464e93162d5bb3d937730ac427000fded116edd279ca53f69d643af2fa62af20ff701e51a584dbddb4725bbe275fa2a786abb68c68d
SSDEEP 98304:emhd1Urye0JrvM2ESV7wQqZUha5jtSyZIUS:elUJrvM5S2QbaZtlir
TLSH
T18356BF05DBE8EF1EC91F03B590B2222657FAD894E783AFD6A951F5B07E82350BD02153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/1680-0-0x0000000000400000-0x0000000000849000-memory.dmp