Overview

overview

10

Static

static

10

2025-04-15...er.exe

windows10-2004-x64

10

2025-04-15...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    112s
  • max time network
    103s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/04/2025, 13:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-15_7c6e22f14877f1a6a33d6a0c0eccb94f_amadey_elex_smoke-loader.exe

  • Size

    6.0MB

  • MD5

    7c6e22f14877f1a6a33d6a0c0eccb94f

  • SHA1

    9735d159e9fb99f5367e36ebe7b3bb81c236ee67

  • SHA256

    05ef13e1af1913553f7660a18904ce9f165cf5e1a6a0277cb8e4f6e9d1465c1e

  • SHA512

    a8dabb001fad1ce039f4eeaab98728098c2a2933a4994e3779e26a4f583a7d837f322c50bb113c643f79ad8b912198665615405859486a21e6a18d6ab611a875

  • SSDEEP

    24576:lKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKO:JjLuSh3i+FtvkMzT+3HfOGlk2Ph0fhev

Score
10/10
pandastealerdiscoveryspywarestealer

Malware Config

Signatures

  • Panda Stealer payload 1 IoCs
  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer
  • Pandastealer family
    pandastealer
  • Drops startup file 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-15_7c6e22f14877f1a6a33d6a0c0eccb94f_amadey_elex_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-15_7c6e22f14877f1a6a33d6a0c0eccb94f_amadey_elex_smoke-loader.exe"
    1⤵
    • Drops startup file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet && wmic shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      PID:244
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C echo ^[autorun^] >autorun.inf
      2⤵
      • Drops autorun.inf file
      • System Location Discovery: System Language Discovery
      PID:808
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C echo ^open^=KasperskyScan^.exe >>autorun.inf
      2⤵
      • Drops autorun.inf file
      • System Location Discovery: System Language Discovery
      PID:4900
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C echo ^execute=^KasperskyScan^.exe >>autorun.inf
      2⤵
      • Drops autorun.inf file
      • System Location Discovery: System Language Discovery
      PID:3152

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
    Filesize

    6.0MB

    MD5

    7c6e22f14877f1a6a33d6a0c0eccb94f

    SHA1

    9735d159e9fb99f5367e36ebe7b3bb81c236ee67

    SHA256

    05ef13e1af1913553f7660a18904ce9f165cf5e1a6a0277cb8e4f6e9d1465c1e

    SHA512

    a8dabb001fad1ce039f4eeaab98728098c2a2933a4994e3779e26a4f583a7d837f322c50bb113c643f79ad8b912198665615405859486a21e6a18d6ab611a875

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\autorun.inf
    Filesize

    65B

    MD5

    fbefa88e6b51c05dd63d97dfdbeb3589

    SHA1

    67e09918d878c6615befab5dc9194439027f268d

    SHA256

    3861acedffd29452d2fdb96728f7347652bde9353915d3873a7414843f49b8b1

    SHA512

    58f8c1a64f2eb21be7b96db335d1ade0ce0878566a8386b3689b650132ca28e14761b20fdfe50f2af9915dff2bdd3a5b07f6f3ed082e4e6998ec5f0cd052f12f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\autorun.inf
    Filesize

    37B

    MD5

    3883f693b2911e7b9cabaf1d89601ebd

    SHA1

    a733bc5b66e5b7beb1ab54ce430ff16cdb935fcb

    SHA256

    747ea7ec54ee0bc9b637867de0c451df65c840f757988f5a3b6e3fe6c73ab1b6

    SHA512

    41fb0555004f392f2c67fd7675d2aea2a7a28a4f51d92237fdaff2d60624c559a5401335887b66f49a721dff669f8f9bd150fde0afe0845eb366309ca1088a98

    Download Submit

  • memory/2252-0-0x00000000743DE000-0x00000000743DF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2252-1-0x0000000000D10000-0x0000000000D18000-memory.dmp

    Filesize

    32KB

    Download

  • memory/2252-2-0x0000000005E50000-0x00000000063F6000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2252-3-0x00000000057C0000-0x0000000005852000-memory.dmp

    Filesize

    584KB

    Download

  • memory/2252-4-0x00000000059B0000-0x00000000059BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2252-5-0x00000000743D0000-0x0000000074B81000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2252-2702-0x00000000743DE000-0x00000000743DF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2252-2873-0x00000000743D0000-0x0000000074B81000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.