c06cbbd8186b6cbe8091178acf429f4c16ad0413628d555cc308806672ae4ba2

Analysis

max time kernel
149s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe
Size 1.9MB
Sample260805-acchestcpg
SHA256 c06cbbd8186b6cbe8091178acf429f4c16ad0413628d555cc308806672ae4ba2
MD5 f72f43b4055d70be1afaae42695c4fb0
SHA1 f2b845ca364179ebce645432044a71e60443a1b4
SHA512 99bf62b0dc09b87a45492381f359454471cc5a45e3bb652f34b7d0191521d6a9aa0d52d54ff3feb891c32484a783fbddfbc99b1048fc4dec57afe23c60b7ed82
SSDEEP 49152:Qoa1taC070dacT5mgPKIHG1ZfwYOOQzQgN8:Qoa1taC09ckgPjQZfpOOQQgW
TLSH
T127952290F7D0C1B2C0815A70A591C7E6A8797E7D8641DD43BBDC6B3F2DA0EC42A62B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3856	7F2E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3856	7F2E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7F2E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 3856	3120	2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Local\Temp\7F2E.tmp
  "C:\Users\Admin\AppData\Local\Temp\7F2E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-04_f72f43b4055d70be1afaae42695c4fb0_amadey_elex_smoke-loader.exe D4BCA820400AD09059EE5705A9529437AE44CED582FD84D1328FE35FB4EC206711074D0B0CD2E3187DF04A205ED6BAD9836BCC7B44B1DFE32B732B03F7F7C9E6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7F2E.tmp

Path C:\Users\Admin\AppData\Local\Temp\7F2E.tmp
Size 1.9MB
SHA256 b78d8536d2a1da253568c500e316bbbfb40ad5a2b6a1ddbfe802ed75c989db16
MD5 81892b4b154129c523b8f4ba22640e7b
SHA1 4fddcb00ed9154c66e0846c290f69bf63af5380d
SHA512 6aef1ff5775cd69146be4fe5beed9a17aa23b112d942a6286dbfb0e0105d7d7fb2765ffac6e1a40f9499a569cd97dfe4a773dfada8ec4fb3e7e53ea0831d6eb4
SSDEEP 49152:Qoa1taC070dK7JSw7dTjIpWNvbGdRkGD3y:Qoa1taC09tSwxoENvSXhry
TLSH
T1E4952310F795D2B1D4920671B262D7D798697E7E53028C837FC81B3F2DA0EC46A22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3120-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/3856-5-0x0000000000400000-0x00000000005E6000-memory.dmp