Analysis
- max time kernel
43s - max time network
45s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/05/2026, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe
- Size 5.1MB
- Sample260502-e8rpfacz7n
- SHA256 649cf04b196d64253bcd2fd73d590b866baa01e383c9225facedf69c8a5c28aa
- MD5 0484d25d4abd431915e072f3a9f06a55
- SHA1 87254b95597c81dac952007065640ba344491335
- SHA512 74e503b39473b0c73325109b79601a77c00e92b86214e07ab8a7877baa2b0360ef9b7385995a4de0d03a315a71deeddbb24fd668ee5ae731de89a5a08ecdd4a3
- SSDEEP 98304:ueSfN1N/D3X1fV8kEZqQ31QnK64z70orXhwAFH6e9VA4jp4vaaacP5T7YuCB4tG9:uttjwpY5qQ6A+uTk
- TLSH T1EE46012E3BE810B0DD743670C4B78BEB8F5C15119BA673CB95960E3148B1AC26D7E6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\B: wmplayer.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "165" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-312252282-3884318443-358092420-1000\{04FBA17D-3461-4DC5-BC94-29A7B816AC3E} wmplayer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3960 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 5024 wmplayer.exe Token: SeCreatePagefilePrivilege 5024 wmplayer.exe Token: SeShutdownPrivilege 404 unregmp2.exe Token: SeCreatePagefilePrivilege 404 unregmp2.exe Token: SeShutdownPrivilege 5024 wmplayer.exe Token: SeCreatePagefilePrivilege 5024 wmplayer.exe Token: SeShutdownPrivilege 3688 shutdown.exe Token: SeRemoteShutdownPrivilege 3688 shutdown.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3960 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe 5024 wmplayer.exe 3960 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3960 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe 3960 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3960 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe 4312 LogonUI.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3960 wrote to memory of 5024 3960 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe 85 PID 5024 wrote to memory of 404 5024 wmplayer.exe 86 PID 3960 wrote to memory of 3688 3960 2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-02_0484d25d4abd431915e072f3a9f06a55_amadey_elex_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Program Files\Windows Media Player\wmplayer.exe"C:\Program Files\Windows Media Player\wmplayer.exe" "C:\Users\Admin\AppData\Local\Temp\mi_video.mp4" /fullscreen2⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:404
-
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown /r /f /t 02⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:3064
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39b8055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 64KB
- SHA256 f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8
- MD5 987a07b978cfe12e4ce45e513ef86619
- SHA1 22eec9a9b2e83ad33bedc59e3205f86590b7d40c
- SHA512 39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa
- SSDEEP 3:Akallkltlsl7pl+e/lls4XplsMlOI1Xlldl0lcNklltlwzl4hR/mll:AN+1E3+e9XplskOI10cAe
- TLSH T1FD539204E3609562C8048377A4EA0B47B331F0690A1AEB1B602A64381C422DA2CA0180
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 b0c2fec61cd15c8576f32fdccbd01473be0741b29c305f8b5775aed7626000d7
- MD5 7b5601ebdf160f782d8282bd4523f1b1
- SHA1 d77e19dd3e1bd809a9afb9a0b74354657cd9b96b
- SHA512 84c269178c35b1656fa7b57fbb8c2d8a63981e2371c52e9c0bd1166baa38900465b338ee1ad93a74fb64d850ee47a4e1caba4f0be85b387750ac19bf3c97e846
- SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdba5:rZP2tFP3vqY8sqEMNTaBacg
- TLSH T1CE258537D190B0C5CE2C7171E9ED8F09BA23A10B12A052465FF8A57E7A533D99D0B1EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131
- MD5 5433eab10c6b5c6d55b7cbd302426a39
- SHA1 c5b1604b3350dab290d081eecd5389a895c58de5
- SHA512 207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34
- SSDEEP 96:zkZRAF6zyHUhm77yB1pZYCEnfHrHHbB6xTGH+YCLV3zwULJEYCJWyHht3zwFRhRM:BFV0bBPCfUdY
- TLSH T1112292A194818DD206290E275DB95C0DDA8CE9D3822C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\mi_video.mp4
- Size 4.4MB
- SHA256 1b4bf7b0f6bc0004e92501552bd6ffbb83f81b52ed461df0d3901e978778bfd6
- MD5 c9b2a09125f3a90b6933291e408921b2
- SHA1 398b9888d2ba688e8be7e007deb5b200b3704958
- SHA512 9fb1a45e6fe313c059f568e9886da42ed8ca258a63d25f2bfaba992ccdfb0f7f8e201f79e578b777c7747b72fa8fa3613c23ff3addb185bed7d71651e983a89f
- SSDEEP 98304:LN1N/D3X1fV8kEZqQ31QnK64z70orXhwAFH6e9VA4jp4vaaacP5T7YuCB4tGYyEa:ZjwpY5qQ6A+uTM
- TLSH T18F26011E2FE82564DD383775C4B34AEFDF880001CAC763CF545B4A6198A5E8A6DBE5C2
- MD5 SHA1 SHA512 SSDEEP TLSH