8ce455264ff654a68e79cb0622f4e3829132ccce0a8427b2e773318961e0402c

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe
Size 5.4MB
Sample260905-jppsysgq4v
SHA256 8ce455264ff654a68e79cb0622f4e3829132ccce0a8427b2e773318961e0402c
MD5 6c681270ac56a05b5062986a1d3a76a9
SHA1 f5881feb067c6ffa27735b505de3416c9e4b4c15
SHA512 9a40fe937374451089969aff046603d6043b1d0bb0aa88bc5821ed1d5e5821ff59a4e7094a88831991026d2a243fa26e88f0adbced565a7e6480fd88b73c8ad5
SSDEEP 98304:emhd1UryeWmd3hMBzFg5rNV7wQqZUha5jtSyZIUh:el2yhqzFarN2QbaZtliU
TLSH
T12946CF0486F8DF2EC91F41B5E0A122669BF1E964E7C3AF967C52F1F43A43350B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3408	BE79.tmp

Executes dropped EXE 1 IoCs

pid	Process
3408	BE79.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BE79.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3408	4192	2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\BE79.tmp
  "C:\Users\Admin\AppData\Local\Temp\BE79.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-04_6c681270ac56a05b5062986a1d3a76a9_amadey_elex_smoke-loader.exe 67A8D515F28366E1E3CBE456AD9238E1B8D5C54B7EE4C1D2BBA81C90180BEA63579C0224096F70915AFAA8736F4C588685C23E44F23A2973529F91676E6AAF34
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BE79.tmp

Path C:\Users\Admin\AppData\Local\Temp\BE79.tmp
Size 5.4MB
SHA256 00d7b3148c93249538ffc199d698c1ae616874f2769501dac9c5cb0320437811
MD5 f7364e5b28ab00a06f9d68ba25a4bb93
SHA1 6b83af462546c2697f795e79918ca55e5c56641d
SHA512 eb0004925ae8314308c606a5d91507965d2ebf51f63ca21d10c4a19a1fd58907616890c40745bf4790f372b7c24ca0c1edcdd2e25af63b288aa323391101d2a1
SSDEEP 98304:emhd1UryePRebylquxBs8V7wQqZUha5jtSyZIUh:elkc2QbaZtliU
TLSH
T19146CF049AF8DF2EC91F01B5E0A122669BF1E964E7C3AF967C52F1F43943350B9461A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3408-5-0x0000000000400000-0x0000000000849000-memory.dmp

Download

memory/4192-0-0x0000000000400000-0x0000000000849000-memory.dmp