Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 16:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_6c532f567fbd9f96ee5ced7884238661_amadey_elex_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-04-17_6c532f567fbd9f96ee5ced7884238661_amadey_elex_smoke-loader_stealc_stop.exe
- Size 7.5MB
- Sample260417-t5wljsdv2j
- SHA256 0bb904664bbfc61bca24542c18709a17564f61680c1854e3490e5b934a173680
- MD5 6c532f567fbd9f96ee5ced7884238661
- SHA1 ea3d5a1e1a185cc73c8f68d4fa19c15f783e75b7
- SHA512 5fee5636d9c1c09483b0faea4cd29bf0e25cc75e21901e95ecb33036d189fc8bff120ad79d4d4ec6f2ffdd31964a8e81c0b01e472ab3856306310506e6bc82ed
- SSDEEP 196608:BDlzFnyNNTWraEnbgZbEueqcpLm58fcpRA1MH4udn:BDRFyNMTbgWueqqm5804wV
- TLSH T1F08633113699B432C13484376CC72A00FDF9DA64159768CA6BCC2EB93F286E0D7767A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation 2026-04-17_6c532f567fbd9f96ee5ced7884238661_amadey_elex_smoke-loader_stealc_stop.exe Key value queried \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation iBOX PRO800 Signature X.exe - Executes dropped EXE 3 IoCs
pid Process 2540 iBOX PRO800 Signature X.exe 2200 AutoUsbDrive.exe 2144 setup_br.exe - Loads dropped DLL 64 IoCs
pid Process 2540 iBOX PRO800 Signature X.exe 2144 setup_br.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2144 setup_br.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iBOX PRO800 Signature X.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AutoUsbDrive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_br.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_6c532f567fbd9f96ee5ced7884238661_amadey_elex_smoke-loader_stealc_stop.exe - NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x00070000000243a0-39.dat nsis_installer_2 behavioral1/files/0x00070000000243ac-46.dat nsis_installer_1 behavioral1/files/0x00070000000243ac-46.dat nsis_installer_2 - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2540 iBOX PRO800 Signature X.exe 2540 iBOX PRO800 Signature X.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4604 wrote to memory of 2540 4604 2026-04-17_6c532f567fbd9f96ee5ced7884238661_amadey_elex_smoke-loader_stealc_stop.exe 86 PID 2540 wrote to memory of 2200 2540 iBOX PRO800 Signature X.exe 88 PID 2200 wrote to memory of 2144 2200 AutoUsbDrive.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_6c532f567fbd9f96ee5ced7884238661_amadey_elex_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_6c532f567fbd9f96ee5ced7884238661_amadey_elex_smoke-loader_stealc_stop.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\iBOX PRO800 Signature X.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\iBOX PRO800 Signature X.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\AutoUsbDrive.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\AutoUsbDrive.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\setup_br.exeC:\Users\Admin\AppData\Local\Temp\setup_br.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2144
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\AutoUsbDrive.exe
- Size 4.0MB
- SHA256 c5ea3d701d3db8c1d082a07d1203c835a0a63e46af5f46ddd8b4349cada9a835
- MD5 6f216c0d3397139a953249b689465619
- SHA1 926cf5223c62fd44dbb0c6b741687e759095d766
- SHA512 48799a8b411e14c85d6eceb386758a6f30b1740f93955ed85e7660e1f91aa6ea15e4c986d80c956a1f835ca171d0af3083223cc5f192fad4a2da203b10d8b754
- SSDEEP 49152:Ju2ZovlJjoXfDGT5f2NN2aDvAarDjLJaUmVju63v5k6pEWKn:Jxol5oXs5f272G7DjLJaUiuuG+E
- TLSH T19716F111B2C1C036F22107788957C6A9943ABE704B3C20CBF7D97A6D2A752D65D373AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\BMC51xUSB.dll
- Size 44KB
- SHA256 c5b9d9b3ae35600779f1abcdf17c01b66980d099d02f51a709ffb98173788232
- MD5 ccb7d3829869bcbb07d7a47209501437
- SHA1 324c253eb596d17c6ce53717812e92885ea723c0
- SHA512 9085baf43a3e918b20bbf18876648953d497dbc08edadba572092e75891d2a0ed2890a409d0472697688d038c7d681138b079eb02994cdab34cf982c944740fc
- SSDEEP 768:Ofvm3tQmi4Gie6tn13DL7gRGXsJAn5tZYAn8D3s3:OHm32mdTe6t13DLsGX3ubDM
- TLSH T145136C11B45295F2C09A46755AE94F166B7F69400BF100C72FBA1A9EEF323F0A63B347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\iBOX PRO800 Signature X.exe
- Size 407KB
- SHA256 ff328405b82ecf2a80fb5878ee0f5cf5e996ad8888318f36aa89709d68b7d7bd
- MD5 29b2cbdb3bce577694cc28b4bb62f459
- SHA1 86b7a2cda3ec7f148c8bdd3bf8bf8c7a9b029813
- SHA512 767665a87b0d3855cb0ed1142fcc68722b6ccf67e3be70683118cf99f2f519d23cbedb708c54b9245fa3d001fc923616fc34150b43c942497f9e4a2488966fb5
- SSDEEP 12288:OEwiUp6F6YpsXrHx0l/1yQ+/xMZN39AY1d0Ro:OEipg6Ypax0lfPt90Ro
- TLSH T1D8945B217790C432D2733132CA66D2BD69ADBC704E35938F66943B3F9E745C29A3871A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\lang.ini
- Size 1KB
- SHA256 6323d245bc4005526cccf20e511f707d4b56031b954e62c06e4996d919ec39e1
- MD5 ecdea1b1dd16be2c84ba8797fefcd0bc
- SHA1 53479f9bb4a25197daaf803cf5456b0b7bf8a876
- SHA512 4261720883175fe6fffdb3df9c0d43932436c0be5c2cb462801f2d7adcba7b7ee4e4ccef1043a335c521ce95058b5725f24c87c428a07b329a6dc2cffab7b5de
- TLSH T17421511F98794212A494E24086D107E761E77A19A73E56F049CB2F9AB3E4535332378F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy1A3B.tmp\LangDLL.dll
- Size 5KB
- SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
- MD5 9384f4007c492d4fa040924f31c00166
- SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
- SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
- SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
- TLSH T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy1A3B.tmp\StartMenu.dll
- Size 7KB
- SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
- MD5 a4173b381625f9f12aadb4e1cdaefdb8
- SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
- SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
- SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
- TLSH T102F1E8BAF7C109B2CA4B5A302C177B178F66E621032561B3CA6356CAB5C15F3ED25712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\setup_br.exe
- Size 532KB
- SHA256 cfc5c3662c08d7d09c7f6e47837cc2dad652d333137cc38e2f72cd4e431afd36
- MD5 392d51b77fa85b120022238bf7fec6bc
- SHA1 ee7766ad5bd9fe3fa8bb69ec2d3340f0136d7015
- SHA512 1ca3bf4c62b0f34bc6efdc45440c0d7e443944905f29954b25ae20c6c6355dd0dccd863c9acbfcbb6e5ade598157a04adfa4d957353e5bf34facf56b6b0644c6
- SSDEEP 12288:QVz7pPs0r0ru3i5fwi1tFuowM3dFAiJNE1349i+L9xniZZ:QVzu0rvy5fwiDFuoj3vAMk6r9Nij
- TLSH T1A5C41319F3D0DA3BF1A89E324AF6E3F3B276F59052004A93BF95671B6C11E50EC29185
- MD5 SHA1 SHA512 SSDEEP TLSH