6f95d657834eabc2834d4a5ab8e24b2eedd3602c4778eafd12664a2f5f4fcd14

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe
Size 2.2MB
Sample260825-3dtgjsxset
SHA256 6f95d657834eabc2834d4a5ab8e24b2eedd3602c4778eafd12664a2f5f4fcd14
MD5 92072162fbdb779ad3ae0ae26619f80b
SHA1 45ebc082387a73f1fa5263c7edc2baff6a8706d1
SHA512 d5710eb48490c95415a56ab95806b859f662c69bff363b0ba6ef337b2fc4100786ec889c7cbb94c4274ec4d69fcf7c0674c63df54b36810c6d57484cda6f2500
SSDEEP 49152:Foa1taC070U4/W1atukYNXwqvOJFIZQvOJFIRK:Foa1taC0/1atukY1
TLSH
T1AAB5F100F70474F3CA14AFB0665AEB9BA2507D7B3745DC8B6884629B1DCF5C89B11F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1732	73C4.tmp

Executes dropped EXE 1 IoCs

pid	Process
1732	73C4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73C4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 1732	2208	2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\73C4.tmp
  "C:\Users\Admin\AppData\Local\Temp\73C4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-23_92072162fbdb779ad3ae0ae26619f80b_amadey_elex_smoke-loader.exe 048DF2F9D19518B71E6728A75251CA85825BED80E80950726FA3B5EA787943EBD74CDA180812891B9B24F2B6FE2A222AF5E8D23A079A6C0F1A338EE13455A9E5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

73C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\73C4.tmp
Size 2.2MB
SHA256 b606bb9c7221af5092589bc74dc760b7b448e925cf9bceb1f4f10964a5df3df6
MD5 6d48b21c0c4c2b06d4c372473d55cec8
SHA1 94db83596a99307186cc9e5ebb4abc8ee1ab41a9
SHA512 3b95e0995090ef35b6c178641ebcaf4934bfcde034351f3c4c71209df72d44a58380ff41679dffce77eb19c9ec4228c80e75b0d77c1eaba1c5fa145e06669483
SSDEEP 49152:Foa1taC070UkY5OaKolpasyF67DlkiXbMRqvOJFIZQvOJFIRK:Foa1taC0NaolpasyF675kfa
TLSH
T1E0B50210B70474F3C6046FB0665AEB57A610797F3705EC8B7884669B1DCFAC89B12F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download