edb92b7482d096c9481bb67ee836f53ebe6935fc1e671cdd93dbaa74b7c01f6b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_115c98aa721d97ad300ed4df7b3c40a8_amadey_elex_smoke-loader_stop.exe
Size 12.2MB
Sample260517-ft79baf19q
SHA256 edb92b7482d096c9481bb67ee836f53ebe6935fc1e671cdd93dbaa74b7c01f6b
MD5 115c98aa721d97ad300ed4df7b3c40a8
SHA1 dc776c59f143cd707486e5fd4a9880604441d72f
SHA512 a79a5739b6f2d4e1fb6255621d11327963a414ffb2dd10230ba6ea06725461d83383c69e97fe68fbd996078fd245f4ef3708ac991b8d3d41b97556b54062a9a9
SSDEEP 393216:F7P77rbs91fM+vJJ0kjAiijQtOWq2Zsnl7tl:FT77rbgNHvJJDEi8QtXcdtl
TLSH
T18FD633679A0A4873E07B8B3304CD0766691DE64AD770B2CF9F0486695FF2BD136A8F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4808	EPFWUPD.exe

Loads dropped DLL 3 IoCs

pid	Process
4808	EPFWUPD.exe
4808	EPFWUPD.exe
4808	EPFWUPD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_115c98aa721d97ad300ed4df7b3c40a8_amadey_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EPFWUPD.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	EPFWUPD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	EPFWUPD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	EPFWUPD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	EPFWUPD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	EPFWUPD.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	EPFWUPD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	EPFWUPD.exe
Key created	\Registry\User\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\NotificationData	EPFWUPD.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	EPFWUPD.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	EPFWUPD.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	EPFWUPD.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	EPFWUPD.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	EPFWUPD.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	EPFWUPD.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	EPFWUPD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	EPFWUPD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	EPFWUPD.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	EPFWUPD.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	EPFWUPD.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	EPFWUPD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	EPFWUPD.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4808	EPFWUPD.exe
4808	EPFWUPD.exe
4808	EPFWUPD.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 4808	2788	2026-05-17_115c98aa721d97ad300ed4df7b3c40a8_amadey_elex_smoke-loader_stop.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-17_115c98aa721d97ad300ed4df7b3c40a8_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_115c98aa721d97ad300ed4df7b3c40a8_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\EPFWUPD.exe
  ./EPFWUPD.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ENBoost.DLL

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\ENBoost.DLL
Size 156KB
SHA256 59f49c95a39083d7d1885260f9b61391649b8b15886e226f0e5db1685a2c0ccc
MD5 cf9a520a93498880cedcd9788b0b39cf
SHA1 5cce2af2d349d776e779638a4d8c1770a20ec7fc
SHA512 a1f0cb9096eadadf4ce3ac0d309a40d06312710047f1dfeea7bcc4ea5b5cbbeaa61e8a2fbbb68afa6d54b9fd0fc5d6c6a12920c60797a1814ffdacbdbcb713bb
SSDEEP 3072:Suw+bWMre9uvPSf2HlYGFD/LJ1uhbJO6N+qqm+SkOrQX:SxqHre9ESf2FYGpLJkhbNNVS
TLSH
T156F39D10FAD3C173C90F527A0075938D4B7F2643AF6299E7FB181B4A8EA02D46D76396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPFWUPD.exe

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\EPFWUPD.exe
Size 3.5MB
SHA256 c6b7bec538a0d707ecec99184821314ed394bb68377498d8d82925b6c516d7c1
MD5 5485d9ebb01ececa4a878c11d8d4f3d5
SHA1 c88727f37daea7a5f4117fe4f9574e36782adc3f
SHA512 f1ab937c9bbf7311e8da29c12ff8269a1049cff22911e39f20669ab4b11e59921d78548d1a0ec9385ada03dd8aa59b8625481be2741215ea1156bb12edddf46d
SSDEEP 49152:bDQQcsL7pqTNw94EIsWFyKA11dsZa4OQ4josRLL5T5NERSpJVwxNs7pMDbsAOyWc:bDQqUe94EIsW8KmfDosRLDO
TLSH
T1D506AD07676D527EEA7F00F5DCA93B9FD61577A06B94A0C7A3887E5C08312C06C76A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWC100TL1.efu

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\FWC100TL1.efu
Size 8.5MB
SHA256 05ce8bb4da2027aec3abd340fec104d6961c5920fc1b5b1c0f6d6b8fa1e57aa6
MD5 17bb5aea88abadfee83593cc181d3a3f
SHA1 f3187ea80d7c3ab8d9546269e1c1648a8aea8547
SHA512 49900ba326782e54612e0d44d2347c3b46985ea174095e20cbebb3103b885fccbd41e216a7439df51dff6bfae0833387df678febdbe824fc90e22ca8fd251c99
SSDEEP 196608:ciYfhXlj9MY9voLbyePlobzgwtp4ViI64iQS8YaH90THl1i5D:XIht9MY9voLGeP0T34Vit4iP8JGTn+
TLSH
T17D9633F71E4518F7F49F49BA3888107DC58640AEEEE1E9C06A065FE8F769F610964C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CP.txt

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Resources\Default\CP.txt
Size 7KB
SHA256 3f4a3a3353461749b3480699c62e48e6f9a2cb4a62a50a695045c29d99814378
MD5 5e4a9950e225c8091b216e159aa76ca6
SHA1 3b021f4f80eb5676cf665394b7553bb3f4841440
SHA512 18d978f118c567169d9c4d1fa3c387ebf616491303727ba82986cedfbe281499f8e0b3b1d540edac509d7c52d719d1515dc7560e4c2e20a72c20c91ad530ee49
SSDEEP 192:azGeZUYm+W78GWWeVSWVAcxZROdwhNMZb:azxtBGWWemYOsM1
TLSH
T1B6F13152A3FA5218F6F73F5469BA12641A7B7C92AD7DD64C1288141D4FF3A40C8B0BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

enres200.dat

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Resources\Default\enres200.dat
Size 60KB
SHA256 02bde32b22872e518253a42edbf635a51870a0f30ca2d3d25a8fc7abb4adf928
MD5 08bdaa8eb241c9c27008f91500c850a5
SHA1 0acfb7d37965db371de42b045043cb4fd2fe0cb4
SHA512 cc40d347c7ef806846e901d0a8e475260225dc489d0477cd13c0823077abc835cf0b4f3757e76f43b48612e227565a54367f28bcf177edb224ace8b72c28164d
SSDEEP 768:RwiM6Pt7ZSydgDgdL5wIGeR8n3CyBPdaS+s8fj3VTsrKnKVzUgNykpkEkDj/2tlF:RwiHaSUarsaZTsrLUgNykpkEkDz2tld/
TLSH
T12E5324331D7DC1A2D72540BAA3A710482835937367AB391A39CE567F9FC4F96A480CDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LA.txt

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Resources\en\LA.txt
Size 19KB
SHA256 fc4fa55477ca1c8706db63be3e8e7e0dd2637129550853da944044b4ff81fbbc
MD5 cd879d236563b11bfb545c29959b75c2
SHA1 78a45e55c789390cac9e8260035b3940ab3d542c
SHA512 046c00736ea33b6e80f8474febc6dcd570a969eb721640cc905d615f37e5a750755058cb1facadebc40fdc53f75607331b3ce2efdf9634e640e9aea22330ed8e
SSDEEP 384:+xIsS1M2IAAVkZkGsDxndOLcGsfEL7zRwXRAvM4JrLZ3pbPhiJ:+xIsr7kZkJxUJsfEL7NKRAEithi
TLSH
T15B928951A7FD5608FAFB7F50AEB496285E3A7C96AD7DC24D1250001E0A72E90CE70B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

string.dat

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Resources\en\string.dat
Size 38KB
SHA256 75b971217770ba0da277ecea520b06c42fa1cd4c2cce3ca3f398a919c887cb1b
MD5 e7380c3570d0bb01fdbbe4c01c32ef54
SHA1 a523a8159ab9cf46ec7fa1009df47f0a3fd71eac
SHA512 20682f2c719fac33c39fdb9d3aa54af9afedc31c78ff346419e1f7a7d43e994eb52f5de280d61e1d4e7a633f1873b789fc4d22ecd2f6abc1f2931ac2a35767f0
SSDEEP 768:rt8gzkCrRKlVTRQsKsKKIMgWYrwlvxAL7F49aMb0SLvL:58gzkC17sKK5gWY8E7F49Lbl
TLSH
T1710324057A6D0B3312A281D5E6AF76DADA0B4CBD833B2355A51C907F356A130D4FE3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

info01.html

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Resources\no\info01.html
Size 1KB
SHA256 d6e7e80fd8d00bf38e05c116597ba53f09b3664146fbd9bb9baa963200536ce3
MD5 c3b49beb4f02d78120f16f1e8cfe1a18
SHA1 36d20f6573a37504700f8c1f3be9e5b10ed6797c
SHA512 4e058d049b03304a1c4e2e839377251365b03af8d2e2750ed4fdf28c4ef697b3e264f5790b768e71fd03e67436cfb17b5b81e5740a28481b53a7550d7e0cbbc0
TLSH
T1A3210125F28CF61ED5551293E2B12AE598DFDC3EC7318533A0BB203B51C66692B061B1
MD5 SHA1 SHA512 TLSH

Submit Download

info02.html

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Resources\no\info02.html
Size 1KB
SHA256 89538d2504a62a9658c2082adb3d4ebd95cd989d576814059a9188be9be844bc
MD5 f84f923409d09613028404b18e2cd6ff
SHA1 5fb56e219c56c5ab811f54ab1ebc569fc76a3749
SHA512 58c40c7643a3629e449f190d6df099b6018359e01a277809cb83a914c6352f6e93f7413a9d6b77dc463644de85f93f8a4f702f4cc2dc3945388798dcf378f81a
TLSH
T180212064F68CF51E9055516791F12AE4A89FEC3EC7318533A0BF303B81C66793B060A1
MD5 SHA1 SHA512 TLSH

Submit Download

Unzip32.dll

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\Unzip32.dll
Size 100KB
SHA256 4afcccfe572c4b95dadcb3e4d50a82b049b01c40ec4c608aa287090db43eb291
MD5 e43f51e3ebf6443aa39b3672a112bb45
SHA1 00830c204c9214a2661e15c2fa1f6c3693ab942b
SHA512 f68757e7e70dbd5be5277a7fdb2ae3f977bc41025a935886afff5480d3f2ea592cb66ebd3b99145575faf53578edbc84730d064bfdf4423bf3bfdde30b424a4d
SSDEEP 1536:Tlxw+ceTBi+n2wikcHfwx8knjTTzAYkqY8Nt4:TbHTBig2BkcYSk3AxqYS4
TLSH
T1ACA37D0239CD10F9EA89633F15021F3E9B3B81293199A65D733CEDF25B19781A3AD356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4808-887-0x00000000030D0000-0x00000000030E9000-memory.dmp

Download

memory/4808-900-0x0000000006610000-0x0000000006611000-memory.dmp

Download

memory/4808-902-0x0000000006610000-0x0000000006611000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads