Overview

overview

7

Static

static

3

2025-04-12...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/04/2025, 23:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-12_060029c8c2aca9ed45367e412b298557_amadey_elex_mafia_smoke-loader.exe

  • Size

    1.6MB

  • MD5

    060029c8c2aca9ed45367e412b298557

  • SHA1

    85d5f41f531e65d8435dde3bf7f2fe6d19412f9e

  • SHA256

    c9c0e8c7ef86cf19ac93b4d5742aeb666c815e6dfdb5585e4b87b1dfb5bf56c1

  • SHA512

    e2a3322bf729a7d8cb61b958a39c3320436ff872e91df0cd36b112cf210ac42288445a582ae3b8de9008cfbb3fb7641ad92b724a05cf4066baa9f101a2a91f91

  • SSDEEP

    24576:YvO2xJKRI2FOkx2LFEvcUQPxuZ98Es8k3OH3C0rQ6+8pKJJFo3Q+qdCOKIbAKjH4:YHHKO29Qm5QZuTtS0rQMYOQ+q8CEKT4

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Unexpected DNS network traffic destination 16 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 15 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-12_060029c8c2aca9ed45367e412b298557_amadey_elex_mafia_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-12_060029c8c2aca9ed45367e412b298557_amadey_elex_mafia_smoke-loader.exe"
    1⤵
    • Unexpected DNS network traffic destination
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5556
  • C:\Windows\Syswow64\16282e52
    C:\Windows\Syswow64\16282e52
    1⤵
    • Executes dropped EXE
    • Unexpected DNS network traffic destination
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3816

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\16282e52
    Filesize

    1.6MB

    MD5

    132edc4b894340d4dc8fe756ceab1343

    SHA1

    7229610ad6a2a082c7a40d1ba397883081103361

    SHA256

    846f963a5cd08aad24866854560ef664e571010a3e345d33290ba77879f595a4

    SHA512

    b2af28063787354fcd749cd1167c4298e6191c6c44227fa80b31c2000e507b82fb860ea099676b6d2986fc489d1180f719f59cf1f505f4a27453c1d4c82a2837

    Download Submit

  • memory/3816-4-0x0000000000C50000-0x0000000000CB3000-memory.dmp

    Filesize

    396KB

    Download

  • memory/5556-0-0x0000000000B70000-0x0000000000BD3000-memory.dmp

    Filesize

    396KB

    Download