Malware Analysis Report

2025-05-06 00:03

Sample ID 250420-w9tzma1yct
Target 2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader
SHA256 dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a
Tags
netwire remcos spot1511 botnet discovery persistence rat stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V16

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dc7b0a7722de1f9abdea3589970b0803d7b807e5c05bb96ea091d29d15255d5a

Threat Level: Known bad

The file 2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader was found to be: Known bad.

Malicious Activity Summary

netwire remcos spot1511 botnet discovery persistence rat stealer

Netwire

NetWire RAT payload

Remcos

Remcos family

Netwire family

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

NSIS installer

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-04-20 18:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-04-20 18:37

Reported

2025-04-20 18:40

Platform

win10v2004-20250314-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Remcos

rat remcos

Remcos family

remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Netframework.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\RxWindriver.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdaters = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97028583\\WQMVJK~1.BAT C:\\Users\\Admin\\AppData\\Local\\Temp\\97028583\\suwbmcn.eme" C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdaters = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02611875\\DHIDHB~1.CMD C:\\Users\\Admin\\AppData\\Local\\Temp\\02611875\\sktfl.wts" C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2484 set thread context of 5916 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3868 set thread context of 2804 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\nb673-full.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\RxWindriver.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Netframework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\nb673-full.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Roaming\nb673-full.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1560 wrote to memory of 5224 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\nb673-full.exe
PID 1560 wrote to memory of 5224 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\nb673-full.exe
PID 1560 wrote to memory of 5224 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\nb673-full.exe
PID 1560 wrote to memory of 5976 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\RxWindriver.exe
PID 1560 wrote to memory of 5976 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\RxWindriver.exe
PID 1560 wrote to memory of 5976 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\RxWindriver.exe
PID 1560 wrote to memory of 5388 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\Netframework.exe
PID 1560 wrote to memory of 5388 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\Netframework.exe
PID 1560 wrote to memory of 5388 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\Netframework.exe
PID 5976 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\RxWindriver.exe C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
PID 5976 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\RxWindriver.exe C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
PID 5976 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Roaming\RxWindriver.exe C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
PID 5388 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Roaming\Netframework.exe C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
PID 5388 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Roaming\Netframework.exe C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
PID 5388 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Roaming\Netframework.exe C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
PID 2484 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2484 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2484 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2484 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3868 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3868 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3868 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 2484 wrote to memory of 5916 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3868 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3868 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe"

C:\Users\Admin\AppData\Roaming\nb673-full.exe

"C:\Users\Admin\AppData\Roaming\nb673-full.exe"

C:\Users\Admin\AppData\Roaming\RxWindriver.exe

"C:\Users\Admin\AppData\Roaming\RxWindriver.exe"

C:\Users\Admin\AppData\Roaming\Netframework.exe

"C:\Users\Admin\AppData\Roaming\Netframework.exe"

C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat

"C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat" suwbmcn.eme

C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd

"C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd" sktfl.wts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\97028583\WQMVJK~1.BAT C:\Users\Admin\AppData\Local\Temp\97028583\suwbmcn.eme

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\02611875\DHIDHB~1.CMD C:\Users\Admin\AppData\Local\Temp\02611875\sktfl.wts

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 nvdiedico.knowsitall.info udp
SE 198.167.194.117:3297 nvdiedico.knowsitall.info tcp
US 8.8.8.8:53 wire.mine.nu udp
SE 198.167.194.117:9702 wire.mine.nu tcp
US 8.8.8.8:53 dico.is-a-hard-worker.com udp
US 8.8.8.8:53 roxy.is-by.us udp
US 8.8.8.8:53 nicholds.dyndns-web.com udp
US 8.8.8.8:53 nvdiedicozeus.dyndns-web.com udp
US 8.8.8.8:53 nvdieroxy.servebbs.org udp
US 8.8.8.8:53 nvdiedicob.is-a-chef.org udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
SE 198.167.194.117:3297 wire.mine.nu tcp
US 8.8.8.8:53 dico.is-a-hard-worker.com udp
US 8.8.8.8:53 roxy.is-by.us udp
US 8.8.8.8:53 nicholds.dyndns-web.com udp
US 8.8.8.8:53 nvdiedicozeus.dyndns-web.com udp
US 8.8.8.8:53 nvdieroxy.servebbs.org udp
US 8.8.8.8:53 nvdiedicob.is-a-chef.org udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
SE 198.167.194.117:3297 wire.mine.nu tcp
US 8.8.8.8:53 c.pki.goog udp
NL 173.194.69.94:80 c.pki.goog tcp
US 8.8.8.8:53 dico.is-a-hard-worker.com udp
US 8.8.8.8:53 roxy.is-by.us udp
US 8.8.8.8:53 nicholds.dyndns-web.com udp
US 8.8.8.8:53 nvdiedicozeus.dyndns-web.com udp
US 8.8.8.8:53 nvdieroxy.servebbs.org udp
US 8.8.8.8:53 nvdiedicob.is-a-chef.org udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
US 8.8.8.8:53 nvdiedico.knowsitall.info udp
SE 198.167.194.117:3297 nvdiedico.knowsitall.info tcp
US 8.8.8.8:53 dico.is-a-hard-worker.com udp
US 8.8.8.8:53 roxy.is-by.us udp
US 8.8.8.8:53 nicholds.dyndns-web.com udp
US 8.8.8.8:53 nvdiedicozeus.dyndns-web.com udp
US 8.8.8.8:53 nvdieroxy.servebbs.org udp
US 8.8.8.8:53 nvdiedicob.is-a-chef.org udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
SE 198.167.194.117:3297 nvdiedico.knowsitall.info tcp
US 8.8.8.8:53 dico.is-very-bad.org udp
US 8.8.8.8:53 dico.is-a-hard-worker.com udp
US 8.8.8.8:53 roxy.is-by.us udp
US 8.8.8.8:53 nicholds.dyndns-web.com udp
US 8.8.8.8:53 nvdiedicozeus.dyndns-web.com udp
US 8.8.8.8:53 nvdieroxy.servebbs.org udp
US 8.8.8.8:53 nvdiedicob.is-a-chef.org udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
SE 198.167.194.117:3297 nvdiedico.knowsitall.info tcp

Files

C:\Users\Admin\AppData\Roaming\nb673-full.exe

MD5 de277032de998ff27f75e0cbfb4b7b6b
SHA1 9d88f2fa882e9c22a353e13387bd7f7005ade51d
SHA256 47297aac91fa6670efb15c70c80e99656b3fbc5598c2e93304225bbbe6f1a266
SHA512 b1cb388f356e929c8bde60770e8a0404f0c4c39b724004fd80001a5f0637e892991cc4c0a807cb8358fa0bdbe4cf9819ece0a5ab9503d0103f08d32e7e4d2514

C:\Users\Admin\AppData\Roaming\RxWindriver.exe

MD5 d323f3245223177b63de1ecbe3f47663
SHA1 ed7c2f0a5bd951b946a471cc7d5771ce6a5f61dc
SHA256 f82e132f601da9270a40d268809974af7aa406a75e2fa63075a9c3fa3e35673c
SHA512 c3b7a7e6b0b95e3ef3cc9766430596d812ce5844ed45c0ad016b6998aa4e7e71602cf2f4b16100aac4406bef2255f5c88354b87cc3cfbfbace50b06974ec9d79

C:\Users\Admin\AppData\Local\Temp\nsx66AA.tmp\UserInfo.dll

MD5 c22c9d7b6937b8960fba4c8a145076b2
SHA1 2e45c2dd6e5132a942fe940dccdaf771e0f9e81e
SHA256 510e466a715933499fb9d5a1753b483826b2bf89161b9d466dd2ad7e52ede2fc
SHA512 b3b93fb97bc0d16ac35a1f0e877bcf42324e19d21839b025329d1b27d8e96bc9c0cbde0a8d60b23fd0c864f62e3c287461108c6abecf53ac488de1fc16b47d6e

C:\Users\Admin\AppData\Roaming\Netframework.exe

MD5 6b60dfc1c2ff57eb2a32423995c766e8
SHA1 adcd8abb899c4e009216384dcf1f54ed5ba52819
SHA256 b21f28cf27f33b0ef78a2b1a5040f48fe8a13e5553ee870b1a77d8aefc7aa81b
SHA512 7d303c9eb3953173694ac6a87aa5dc4eeb1a21ed480a48e776dfbec5822468bcec84ccece786ab7a3483a3e4e4824462444535d23bf23e42cf67bd4a5707cb0b

C:\Users\Admin\AppData\Local\Temp\nsx66AA.tmp\LangDLL.dll

MD5 b26b412d9f1050ad53f663c972fdcd9f
SHA1 7bc4ed444f3f8fd14c2c36784d828175bace8c17
SHA256 70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
SHA512 ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46

C:\Users\Admin\AppData\Local\Temp\nsx66AA.tmp\System.dll

MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

C:\Users\Admin\AppData\Local\Temp\nsx66AA.tmp\cpudesc.dll

MD5 d25102051b33f61c9f7fb564a4556219
SHA1 c683964c11d5175171bd009cb08f87592c923f85
SHA256 e58e5d1d8da2ea526d0d754b4faad3773021166b0720723efb7b30f1f5075398
SHA512 8828eec31926251d7e51b5bf1050c3519c9b7fca4f978fb6ee0bf18f9642c3460687f10ff79e5892100ecadbf49725711567c348e1dfccb3644bd9ef992a92f0

C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\AppData\Local\Temp\97028583\nrveb.msc

MD5 8296a539bec586333a216bca6dba8bbd
SHA1 696098c5bde90f2fda807dd7b42a744ee55965a7
SHA256 aa05bf9b4485d0cc21eb8881828136cca038ce7676bd1aa0e3df2bd60e80efc1
SHA512 c31cc0466f549e42672fe4d5aa9c8a24383210a6db1e4d141678170666711b3b9dec3d9400e7c18c8e2c5710ca7d2c859597ccefd04d8b2fecd44424428585e4

C:\Users\Admin\AppData\Local\Temp\02611875\jalabegr.txt

MD5 6f3aa0896874ab108c07673ff22978bd
SHA1 787c20c688a551560c1119581da7bcc1aa754dad
SHA256 8f3c8402a49c242cad6162f1c4f178cd7d2c7aa23bb34fea473144f2e3c438af
SHA512 28e403c1373c8c282ed57a034b25a258503caf669669aaf7bd869db340be8120f910724c79ceb8a0f010a9d58cb4000e4cd932b223df69c3b7bef3194bceea34

C:\Users\Admin\AppData\Local\Temp\nsx66AA.tmp\UAC.dll

MD5 4814167aa1c7ec892e84907094646faa
SHA1 a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee
SHA256 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822
SHA512 fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067

C:\Users\Admin\AppData\Local\Temp\nsx66AA.tmp\nsDialogs.dll

MD5 b3070cf20db659fdfb3cb2ed38130e8d
SHA1 aa234b0620bebddde1414ff6b0840d883890b413
SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 9d352bc46709f0cb5ec974633a0c3c94
SHA1 1969771b2f022f9a86d77ac4d4d239becdf08d07
SHA256 2c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA512 13c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b

memory/5916-317-0x0000000001100000-0x0000000002100000-memory.dmp

memory/5916-315-0x0000000001100000-0x0000000002100000-memory.dmp

memory/5916-321-0x0000000001100000-0x0000000002100000-memory.dmp

memory/5916-318-0x0000000001100000-0x0000000002100000-memory.dmp

memory/2804-322-0x0000000000900000-0x0000000001900000-memory.dmp

memory/2804-324-0x0000000000900000-0x0000000001900000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsx66AA.tmp\InstallOptions.dll

MD5 3e277798b9d8f48806fbb5ebfd4990db
SHA1 d1ab343c5792bc99599ec7acba506e8ba7e05969
SHA256 fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
SHA512 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92

C:\Users\Admin\AppData\Local\Temp\nsx66AA.tmp\GetFLE.ini

MD5 2f1ef11d134be7ac487121b9ed3760c4
SHA1 c39445b7e188f003507945852e3c3930185d5398
SHA256 e506d0a5ada059b1203342677fdbc13d62724d65fd274eedefc721b85edb8e7b
SHA512 73805b81cffadc5e408d2c457a9d5d25cf0436edc53b115913ac685bfdf63e0c1f8f31d6fbb43d4635acf8dd643ca39b899c28cefe95d59b1650e49edec685ac

C:\Users\Admin\AppData\Roaming\remcos\rmlogs.dat

MD5 9480590641673645e2d5df349d7b8d72
SHA1 440432a98e9c3321788832a7acd24aae58ad598d
SHA256 b302bc3e7fa8758589d739c80e6f6c532c99ed838401a71bfa99f12b42279cce
SHA512 17cc92f349756a7b54c01c371185c133e9c86e6bd11cd16be4d54860463634b5c35be783c791f7598b05c5c209787cfc5a8f641254f8e4062bdff1931bfcdc9a

Analysis: behavioral2

Detonation Overview

Submitted

2025-04-20 18:37

Reported

2025-04-20 18:40

Platform

win11-20250410-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe"

Signatures

NetWire RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Netwire

botnet stealer netwire

Netwire family

netwire

Remcos

rat remcos

Remcos family

remcos

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdaters = "C:\\Users\\Admin\\AppData\\Local\\Temp\\97028583\\WQMVJK~1.BAT C:\\Users\\Admin\\AppData\\Local\\Temp\\97028583\\suwbmcn.eme" C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdaters = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02611875\\DHIDHB~1.CMD C:\\Users\\Admin\\AppData\\Local\\Temp\\02611875\\sktfl.wts" C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3016 set thread context of 5488 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 5712 set thread context of 3640 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\Netframework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\nb673-full.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\RxWindriver.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\nb673-full.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Roaming\nb673-full.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5384 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\nb673-full.exe
PID 5384 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\nb673-full.exe
PID 5384 wrote to memory of 2904 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\nb673-full.exe
PID 5384 wrote to memory of 5556 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\RxWindriver.exe
PID 5384 wrote to memory of 5556 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\RxWindriver.exe
PID 5384 wrote to memory of 5556 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\RxWindriver.exe
PID 5384 wrote to memory of 5636 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\Netframework.exe
PID 5384 wrote to memory of 5636 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\Netframework.exe
PID 5384 wrote to memory of 5636 N/A C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe C:\Users\Admin\AppData\Roaming\Netframework.exe
PID 5556 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\RxWindriver.exe C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
PID 5556 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\RxWindriver.exe C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
PID 5556 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Roaming\RxWindriver.exe C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat
PID 5636 wrote to memory of 5712 N/A C:\Users\Admin\AppData\Roaming\Netframework.exe C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
PID 5636 wrote to memory of 5712 N/A C:\Users\Admin\AppData\Roaming\Netframework.exe C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
PID 5636 wrote to memory of 5712 N/A C:\Users\Admin\AppData\Roaming\Netframework.exe C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd
PID 3016 wrote to memory of 5488 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3016 wrote to memory of 5488 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3016 wrote to memory of 5488 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3016 wrote to memory of 5488 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 3016 wrote to memory of 5488 N/A C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 5712 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 5712 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 5712 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 5712 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
PID 5712 wrote to memory of 3640 N/A C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe

"C:\Users\Admin\AppData\Local\Temp\2025-04-20_07ec451b057f8b175ddb971c24d0d740_amadey_elex_smoke-loader.exe"

C:\Users\Admin\AppData\Roaming\nb673-full.exe

"C:\Users\Admin\AppData\Roaming\nb673-full.exe"

C:\Users\Admin\AppData\Roaming\RxWindriver.exe

"C:\Users\Admin\AppData\Roaming\RxWindriver.exe"

C:\Users\Admin\AppData\Roaming\Netframework.exe

"C:\Users\Admin\AppData\Roaming\Netframework.exe"

C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat

"C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat" suwbmcn.eme

C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd

"C:\Users\Admin\AppData\Local\Temp\02611875\dhidhbrvsi.cmd" sktfl.wts

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\97028583\WQMVJK~1.BAT C:\Users\Admin\AppData\Local\Temp\97028583\suwbmcn.eme

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\02611875\DHIDHB~1.CMD C:\Users\Admin\AppData\Local\Temp\02611875\sktfl.wts

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 nvdiedico.knowsitall.info udp
SE 198.167.194.117:9702 wire.mine.nu tcp
US 8.8.8.8:53 nicholds.dyndns-web.com udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
US 8.8.8.8:53 nvdiedicozeus.dyndns-web.com udp
US 8.8.8.8:53 dico.is-a-hard-worker.com udp
US 8.8.8.8:53 nvdieroxy.servebbs.org udp
US 8.8.8.8:53 nvdiedicozeus.dyndns-web.com udp
US 8.8.8.8:53 nvdiedicob.is-a-chef.org udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
US 8.8.8.8:53 nvdieroxy.servebbs.org udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
US 8.8.8.8:53 nvdiedicob.is-a-chef.org udp
US 8.8.8.8:53 nicholds.dyndns-web.com udp
US 8.8.8.8:53 nvdiedicozeus.dyndns-web.com udp
US 8.8.8.8:53 nvdiedicob.is-a-chef.org udp
US 8.8.8.8:53 nerverdieorcus.is-a-doctor.com udp
US 8.8.8.8:53 dico.is-a-hard-worker.com udp
US 8.8.8.8:53 roxy.is-by.us udp
US 8.8.8.8:53 nvdiedico.knowsitall.info udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp

Files

C:\Users\Admin\AppData\Roaming\nb673-full.exe

MD5 de277032de998ff27f75e0cbfb4b7b6b
SHA1 9d88f2fa882e9c22a353e13387bd7f7005ade51d
SHA256 47297aac91fa6670efb15c70c80e99656b3fbc5598c2e93304225bbbe6f1a266
SHA512 b1cb388f356e929c8bde60770e8a0404f0c4c39b724004fd80001a5f0637e892991cc4c0a807cb8358fa0bdbe4cf9819ece0a5ab9503d0103f08d32e7e4d2514

C:\Users\Admin\AppData\Roaming\RxWindriver.exe

MD5 d323f3245223177b63de1ecbe3f47663
SHA1 ed7c2f0a5bd951b946a471cc7d5771ce6a5f61dc
SHA256 f82e132f601da9270a40d268809974af7aa406a75e2fa63075a9c3fa3e35673c
SHA512 c3b7a7e6b0b95e3ef3cc9766430596d812ce5844ed45c0ad016b6998aa4e7e71602cf2f4b16100aac4406bef2255f5c88354b87cc3cfbfbace50b06974ec9d79

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\UserInfo.dll

MD5 c22c9d7b6937b8960fba4c8a145076b2
SHA1 2e45c2dd6e5132a942fe940dccdaf771e0f9e81e
SHA256 510e466a715933499fb9d5a1753b483826b2bf89161b9d466dd2ad7e52ede2fc
SHA512 b3b93fb97bc0d16ac35a1f0e877bcf42324e19d21839b025329d1b27d8e96bc9c0cbde0a8d60b23fd0c864f62e3c287461108c6abecf53ac488de1fc16b47d6e

C:\Users\Admin\AppData\Roaming\Netframework.exe

MD5 6b60dfc1c2ff57eb2a32423995c766e8
SHA1 adcd8abb899c4e009216384dcf1f54ed5ba52819
SHA256 b21f28cf27f33b0ef78a2b1a5040f48fe8a13e5553ee870b1a77d8aefc7aa81b
SHA512 7d303c9eb3953173694ac6a87aa5dc4eeb1a21ed480a48e776dfbec5822468bcec84ccece786ab7a3483a3e4e4824462444535d23bf23e42cf67bd4a5707cb0b

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\LangDLL.dll

MD5 b26b412d9f1050ad53f663c972fdcd9f
SHA1 7bc4ed444f3f8fd14c2c36784d828175bace8c17
SHA256 70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
SHA512 ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\System.dll

MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\cpudesc.dll

MD5 d25102051b33f61c9f7fb564a4556219
SHA1 c683964c11d5175171bd009cb08f87592c923f85
SHA256 e58e5d1d8da2ea526d0d754b4faad3773021166b0720723efb7b30f1f5075398
SHA512 8828eec31926251d7e51b5bf1050c3519c9b7fca4f978fb6ee0bf18f9642c3460687f10ff79e5892100ecadbf49725711567c348e1dfccb3644bd9ef992a92f0

C:\Users\Admin\AppData\Local\Temp\97028583\wqmvjkujg.bat

MD5 71d8f6d5dc35517275bc38ebcc815f9f
SHA1 cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256 fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA512 4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

C:\Users\Admin\AppData\Local\Temp\97028583\nrveb.msc

MD5 8296a539bec586333a216bca6dba8bbd
SHA1 696098c5bde90f2fda807dd7b42a744ee55965a7
SHA256 aa05bf9b4485d0cc21eb8881828136cca038ce7676bd1aa0e3df2bd60e80efc1
SHA512 c31cc0466f549e42672fe4d5aa9c8a24383210a6db1e4d141678170666711b3b9dec3d9400e7c18c8e2c5710ca7d2c859597ccefd04d8b2fecd44424428585e4

C:\Users\Admin\AppData\Local\Temp\02611875\jalabegr.txt

MD5 6f3aa0896874ab108c07673ff22978bd
SHA1 787c20c688a551560c1119581da7bcc1aa754dad
SHA256 8f3c8402a49c242cad6162f1c4f178cd7d2c7aa23bb34fea473144f2e3c438af
SHA512 28e403c1373c8c282ed57a034b25a258503caf669669aaf7bd869db340be8120f910724c79ceb8a0f010a9d58cb4000e4cd932b223df69c3b7bef3194bceea34

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\UAC.dll

MD5 4814167aa1c7ec892e84907094646faa
SHA1 a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee
SHA256 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822
SHA512 fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\nsDialogs.dll

MD5 b3070cf20db659fdfb3cb2ed38130e8d
SHA1 aa234b0620bebddde1414ff6b0840d883890b413
SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

MD5 96c201253a2a277d7e6d40167548991a
SHA1 f3b0e69f65e9a27a5af1d96af75f1a6a23cf77aa
SHA256 808aec47f908410c01f820683f1c33198e05525d159863925690fdeb319eac1a
SHA512 8c2af8688802019fd0c18fcd279ac3821caa0923631610589a6c23663d5200038ad7e3cfe698339ee92cf621ef4ffedf11bc5082cb6ed860eb955dfc60fdacc4

memory/5488-314-0x0000000001390000-0x0000000002390000-memory.dmp

memory/5488-317-0x0000000001390000-0x0000000002390000-memory.dmp

memory/5488-320-0x0000000001390000-0x0000000002390000-memory.dmp

memory/5488-316-0x0000000001390000-0x0000000002390000-memory.dmp

memory/3640-322-0x0000000001030000-0x0000000002030000-memory.dmp

memory/3640-324-0x0000000001030000-0x0000000002030000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\InstallOptions.dll

MD5 3e277798b9d8f48806fbb5ebfd4990db
SHA1 d1ab343c5792bc99599ec7acba506e8ba7e05969
SHA256 fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
SHA512 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\GetFLE.ini

MD5 2f1ef11d134be7ac487121b9ed3760c4
SHA1 c39445b7e188f003507945852e3c3930185d5398
SHA256 e506d0a5ada059b1203342677fdbc13d62724d65fd274eedefc721b85edb8e7b
SHA512 73805b81cffadc5e408d2c457a9d5d25cf0436edc53b115913ac685bfdf63e0c1f8f31d6fbb43d4635acf8dd643ca39b899c28cefe95d59b1650e49edec685ac

C:\Users\Admin\AppData\Local\Temp\nsl7B3C.tmp\GetFLE.ini

MD5 8677b4be1a93c056da1c1dd682cec380
SHA1 5b995749cc5807099f0adbc4bf433b5e8975cf4b
SHA256 b14504f8738188c1c088332fc06ccf835726e168dd70c5461f9f4e5bf058036a
SHA512 5436f89f172646599b6d1b335571ba49e29dbcbf1cdebf1d5e2e15ec00577692509fd22feb59419e56fcc8cc49a38d5a847768d8a4015ebf7419e626b2e72779

C:\Users\Admin\AppData\Roaming\remcos\rmlogs.dat

MD5 6027dfb10987f12bc40e2a7d282e9a0a
SHA1 cb64cd466dcf8504d6b74e91ce4f41912d264ea4
SHA256 ab5d9f4b9265c72b5022c96dee2b759c3ea311bd820199523f3908de4765614d
SHA512 cb7202145f96c3cbc7beca62f1b6f5edba95711cfb6966d4e97eb8bcb91363774fa59659047ea82d7f9dd98de2e358b8a4d7a1a106a613ce75b5e8f54d913bca