Analysis
-
max time kernel
104s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250610-en -
resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
2025-07-04_8dfb9eb86ac79a8bfa8edf9c720fbcf9_amadey_elex_gcleaner_smoke-loader_stop.exe
Resource
win10v2004-20250610-en
Behavioral task
behavioral2
Sample
2025-07-04_8dfb9eb86ac79a8bfa8edf9c720fbcf9_amadey_elex_gcleaner_smoke-loader_stop.exe
Resource
win11-20250619-en
General
-
Target
2025-07-04_8dfb9eb86ac79a8bfa8edf9c720fbcf9_amadey_elex_gcleaner_smoke-loader_stop.exe
-
Size
278KB
-
MD5
8dfb9eb86ac79a8bfa8edf9c720fbcf9
-
SHA1
45270926ce72bdfa345bf6c04619de1af344dd40
-
SHA256
6f5a07dbd1e3e8975fded7630b89cfb1fac97928bcecb339a53aa44541973d72
-
SHA512
0773fd54cc568763b9d7d6dfe59686368089ede9e991e19850e21396d7b32492fce6c0da51e1db315e23544f81e2a1c16b82698f3e2c81084b27a2761551e56f
-
SSDEEP
6144:qKAFwOu2CBtvvQ93MeDm6fLUqn8BMP+AA6k4D68wN:SCBtv+Meq6fYqn8BMWAACD68wN
Malware Config
Signatures
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 11 46.173.209.194 1932 Process not Found Destination IP 10 46.173.209.194 1932 Process not Found Destination IP 43 46.173.209.194 4960 IEXPLORE.EXE Destination IP 6 46.173.209.194 1932 Process not Found Destination IP 7 46.173.209.194 1932 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-07-04_8dfb9eb86ac79a8bfa8edf9c720fbcf9_amadey_elex_gcleaner_smoke-loader_stop.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3555224456" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083fad941d8070d40a2589f5cb25229d600000000020000000000106600000001000020000000459d9dd5fc8a144e8f590df01f4f101821bbf4d2fc0533cb39b048cb14c7a40c000000000e8000000002000020000000a8ba8f5a76c61e9c4e73a3528fd507e5d9048b563bd242044fef7f3387b551c3200000000a544b588a11e4061df10469abeac0d405b8a2a4a7c0ac4d5c8c470be5b031d6400000007ea78be7b7a9505b86dd933e98859a1b7714abd5261fdbb5badba73607d7b4b0b775b7c258ae026842169a7fab71c003a7d3341b668b5c7424cdcb651a05bd03 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31190237" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000083fad941d8070d40a2589f5cb25229d600000000020000000000106600000001000020000000b8cddf7f37d6c5421f5b075cf036c2be26ca0e10c9bcd838b9e2ab60509f147b000000000e800000000200002000000037abb182b783651a4e6df4ba743f8848451000ee664edca014d4ec11916acf26200000003842e37f711bfd3d376e004bebe2878fc710731aca4381ac1a5c8f3d6be85d434000000030d9636bbda095998d291cb58f0142757f0f32eeccc5d3adfccfa0cd68243f2911f864e13f08c1ac407c1ff90cc4565e9614025e87758cee6ae2aea28c545e66 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FF6BCC93-58D0-11F0-B231-CA5E4D1D7EC4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c71ad9ddecdb01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403d24d9ddecdb01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3408 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 5232 2025-07-04_8dfb9eb86ac79a8bfa8edf9c720fbcf9_amadey_elex_gcleaner_smoke-loader_stop.exe 3408 iexplore.exe 3408 iexplore.exe 4960 IEXPLORE.EXE 4960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3408 wrote to memory of 4960 3408 iexplore.exe 94 PID 3408 wrote to memory of 4960 3408 iexplore.exe 94 PID 3408 wrote to memory of 4960 3408 iexplore.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-07-04_8dfb9eb86ac79a8bfa8edf9c720fbcf9_amadey_elex_gcleaner_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2025-07-04_8dfb9eb86ac79a8bfa8edf9c720fbcf9_amadey_elex_gcleaner_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5232
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:2396
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3408 CREDAT:17410 /prefetch:22⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4960
-