Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2025, 13:47
Static task
static1
Behavioral task
behavioral1
Sample
2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe
Resource
win10v2004-20250410-en
General
-
Target
2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe
-
Size
360KB
-
MD5
104052bfe49feca7ec8ee988cfa0c924
-
SHA1
c55e221e9f3ffae645cb9983c05c42b1167a17bd
-
SHA256
a16eb5272505a48ba3d4415f31fdec537d5401c73a498a4db89ebc5042d05599
-
SHA512
37a7aca93da90919e4858331c022036341f570dc3e4a3fd7b6106d4334f1e319ecd0b0322ad05ce9ebd8214f079e0a8484c695b6631b6723612b3cd02e697480
-
SSDEEP
6144:Fd1+vsZ/c2++hdP6E/FY4TQAEXXLgRHe0r7e4F2rTeqB3E4:D1+b2NFYAEXX4e0ne4F2rTX
Malware Config
Extracted
phorphiex
http://twizt.net
Extracted
phorphiex
http://185.215.113.66/
http://185.39.17.124/
TW3wpRJmZgC5WifuY468JBUCF3TEkzBT5H
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MF6iVGLmErYP9y4B9SwtzarDoy3ETSzYrh
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
0x46e5cc402BC848ceC9f4d65c9B48aE7D7A24821B
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1B8FF5WwJXNnjkVzxgPkAznVZ8uKb3Watx
ltc1qyfzdpxky7q2grz4zmqv5x0t0uwfuznl5u43c93
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3GcQJkfHq7NWgBhhNKjz7uSfM6LzADpLvX
CSLKveRL2zqkbV2TqiFVuW6twtpqgFajoUZLAJQTTQk2
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1q9tgkga69k094n5v0pn7ewmpp2kn66sh9hu65gq
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
x5x7x2x9x
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral1/files/0x000d00000002400d-10.dat family_phorphiex -
Downloads MZ/PE file 2 IoCs
flow pid Process 18 440 5F95.exe 1 452 2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe -
Executes dropped EXE 4 IoCs
pid Process 440 5F95.exe 5728 1322313020.exe 4448 sysldrvsn.exe 4788 sysldrvsn.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysldrvsn.exe" 1322313020.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\sysldrvsn.exe 1322313020.exe File opened for modification C:\Windows\sysldrvsn.exe 1322313020.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F95.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1322313020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysldrvsn.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 452 2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe 452 2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe 452 2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 452 wrote to memory of 440 452 2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe 86 PID 452 wrote to memory of 440 452 2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe 86 PID 452 wrote to memory of 440 452 2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe 86 PID 440 wrote to memory of 5728 440 5F95.exe 88 PID 440 wrote to memory of 5728 440 5F95.exe 88 PID 440 wrote to memory of 5728 440 5F95.exe 88 PID 5728 wrote to memory of 4448 5728 1322313020.exe 90 PID 5728 wrote to memory of 4448 5728 1322313020.exe 90 PID 5728 wrote to memory of 4448 5728 1322313020.exe 90 PID 5628 wrote to memory of 4788 5628 cmd.exe 92 PID 5628 wrote to memory of 4788 5628 cmd.exe 92 PID 5628 wrote to memory of 4788 5628 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-17_104052bfe49feca7ec8ee988cfa0c924_amadey_elex_smoke-loader.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\5F95.exe"C:\Users\Admin\AppData\Local\Temp\5F95.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\1322313020.exeC:\Users\Admin\AppData\Local\Temp\1322313020.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\sysldrvsn.exeC:\Windows\sysldrvsn.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4448
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\sysldrvsn.exe1⤵
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\sysldrvsn.exeC:\Windows\sysldrvsn.exe2⤵
- Executes dropped EXE
PID:4788
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD500306e1e4a4230f9dc6b626a68dcbbb0
SHA11d71fc3b6a308396c8f03bdc0ee012b44d7782e9
SHA2568133c11eeec328b9995eec62438ecd87535d540f320beab4642d032661e448b2
SHA5126899d3bac0cf0b493e0f4e85700a40f6ebc433c8319f746e803a948fe9715f00682adb09f967e9a02e6e4bffa020083d12192e1e375fa82a4a648ba28b3d6af9
-
Filesize
10KB
MD521789ebcbfca1eb0c6881e6af6216a81
SHA130152ddbe1150a2a612eb7b08e6551830276c8f0
SHA256c0d12405d2a5cd6064e6e498d6f5f7fd48c72b2d02f171f20f898a4d2832968c
SHA512cf3296247865130e4e769f09280d5f15237bedf474734f7b383130dfd01c5407a081e3f571152c393845b08d8ed48a0b2d23d11e905783332fb2552d20ad4514