ab9ff4fe1eeb2e98c3044b8a8a887b606f33b591500f3fc2ff42ef0a8c15319f

General

Target
2026-07-20_0ea6e296ed97abd4a3cfdbe88053ba0a_amadey_elex_smoke-loader_stealc_stop.exe
Size 33.4MB
Sample260720-mlbcyaey7m
SHA256 ab9ff4fe1eeb2e98c3044b8a8a887b606f33b591500f3fc2ff42ef0a8c15319f
MD5 0ea6e296ed97abd4a3cfdbe88053ba0a
SHA1 bc95a95f3ee7c29abb836bf62db612f4385ba75e
SHA512 4f840b5017aa6294e3467707db0410a5b7baf84a8e2658c00ed2de18c44678abdcd82d16dc0f4d59f3b2bf78f295be0cfb38572ca4c2a01dc9076b8216bec40d
SSDEEP 786432:eB9+ZZLUjGbDcivFNZNXUJvRrzwOPoXU6cv:eBo/4SbFoFRrzxgk6s
TLSH
T1707733D0D28568E6C82771F1B83DDA61291F7E2E52B0191D36BAB91C52B3243ED27D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
996	mame64.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
248	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_0ea6e296ed97abd4a3cfdbe88053ba0a_amadey_elex_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\LastTelemetryChangeStamp = "1"	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{FF3B19CC-0248-4424-BD7C-E078985F4438}	svchost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
996	mame64.exe
1152	OpenWith.exe
2780	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 248	3824	2026-07-20_0ea6e296ed97abd4a3cfdbe88053ba0a_amadey_elex_smoke-loader_stealc_stop.exe	89
PID 248 wrote to memory of 996	248	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-20_0ea6e296ed97abd4a3cfdbe88053ba0a_amadey_elex_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_0ea6e296ed97abd4a3cfdbe88053ba0a_amadey_elex_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\dll.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\mame64.exe
    mame64.exe roms/wof.zip
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:996

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc
1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5968

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.cfg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\cfg\default.cfg
Size 180B
SHA256 e1fd9ac6dab9d6d037ce6937373b35bdd048750a3a5af2e95a403f37b09e2995
MD5 699af169745db2b9dd0a4db1fd4522b7
SHA1 7310a8656b9fbf31d75bc367e968f2da5651618a
SHA512 b7d6c45f78b5654e63a7e75bfba242c3693a61249eb2b4fbf7d06ae588dae00d11f2ea9d1c84c46339c0934e6b88835e8cece45978627895145d47e6a3f83237
TLSH
T1AAC012093784EDB105101D20D60905675730AB696324705D30CE24879B494C913B4A55
MD5 SHA1 SHA512 TLSH

Submit Download

wof.cfg

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\cfg\wof.cfg
Size 3KB
SHA256 2a4b7880a77ffbb3545197f8c5a89648ef196a42094bc135d4207b20caec030d
MD5 ca2d9427b5eb0dbb3661256b22ef7361
SHA1 b72deaa215e1a180275736d7b16c5e823be50c47
SHA512 643aadf1a877f8ea4940abbe976f0035b23d69ede7a46756cb6611b48963cb10b34af7e091d18e28a77c5ff940face79c6e4ddb0170b44c78cde7deb30437fbe
TLSH
T19971DC1356D4D9529274254B63006E8ADFC2A2C7AA411BC8364E13E3BF735D13EB7DC8
MD5 SHA1 SHA512 TLSH

Submit Download

dll.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\dll.bat
Size 51B
SHA256 0cdabbca095dbf5dd470d0d92f0ede1a219f82073fa18eefa12f577f1dded86b
MD5 26f7f9de273ab60218bd01c86b1352ae
SHA1 8f72d11c7dac8c8af0a181042dab94d23df64171
SHA512 6845010bd655991f593fa43e4ced98daddaf7118510855843eb779b61b643e81db040271c5198f164388098f99e9def7509d51f75f964fb231cec21b36926a62
TLSH
T19490026145071CD5481A7D6004977346F04710C548825458318A1620D45745054CAD0D
MD5 SHA1 SHA512 TLSH

Submit Download

mame.ini

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\mame.ini
Size 7KB
SHA256 19d094decc44e46ac05085187c5743abe061e1aad0a8d370fdc7ca83447d78b0
MD5 20b2fc204437f1423892aa5c898502ed
SHA1 3ccda5acccef147932420012915969fc3f37bb1c
SHA512 f411caa108664e882022f8097e32281ffa2c9dc5239c359b7deb8c9e4dc8323ce5b43d59f9a5c97e3698d2f0a1360607f634a79316ae684d5f0d7691f0127204
SSDEEP 192:e3pAEHv7QgDpVSWzNWTZQhqd+vILVovKz1WN2:QAEP5LRMTZi42Bg1WM
TLSH
T18FF1ED12A346B11F4B9DC7326266D104D4D892DBAD1970C2728EDADD1BF3B445BCE24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeprom

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvram\wof\eeprom
Size 128B
SHA256 fc2d691efd2575c59085a2b6408fc96c917f1727298ff3796498a0ecc24a1d47
MD5 f2801d2c84c6d2cbc23795464150eea0
SHA1 f9e68f3903c7c83045ed95ef4b008e9b4abd2621
SHA512 dcc31ed15ebb504524d9b7f8e39b6b2846782d93fecee616820d534763ebbd0165a570a2bfdc12f6b2a327abf0c24141463ab7eabc1fcbc29fb7044707834405
TLSH
T197B09BC1594DC54CD3569036775957641D656C707827550BC5DB14A6CB450D04D8A056
MD5 SHA1 SHA512 TLSH

Submit Download

wof.zip

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\roms\wof.zip
Size 16.8MB
SHA256 463faa87836ff8b558430f115232154dae29bfbfe5cb7cf2333f5e7fefa65fdd
MD5 17cfa832730a4c837272b7875faf57b1
SHA1 f8636896d77b480f244c94b990314ec71af3dcd9
SHA512 46ddd30679d0745518dba6212b8092ede8cb92e65aca79c433e980b65030f287fb242670807b12e3d8139078d9a34cb234b3770bee76b3a7591c93353877d0dd
SSDEEP 393216:MMYaWJW0UN4bML3CQKvDgTockG2kHk3Zz8:MMN6WjN4bMgLgx2G0o
TLSH
T143073391AE74EA62E6B9D9770019379C3F08B170CB1EE0F5CAD3D92E55CCD92171E888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/996-46-0x0000000000400000-0x0000000001400000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads