Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target 2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe
- Size 14.6MB
- Sample260728-e686psar9x
- SHA256 cc421f4b22a36888891c64e45d003f18e42396e4a6fcfb77bbf94e783c8e642b
- MD5 a3e282f3e33c11c8660d2695847417be
- SHA1 05d6215a96b21d23c87e0f8ea82c5e51b58d6bff
- SHA512 310c2a0ffe8bc3025fa08c3b31fe7bd0578db328882e0827c239c85aa0e9d6f1aeba44993bcf7b7a2bd3d7aa1d54e136b05e2f5bc278525be20769db4ceca477
- SSDEEP 393216:OeJWGhrr2GcT9nKF/jwOlhjriPt1b+yOAVZiqUz:yGhwKF/jXRkt1b+yhZiqUz
- TLSH T10EF63306B286C872C550167164771BFA9B313D12FE25DC6A6368BECD2CF13D119BA2CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation 2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe - Executes dropped EXE 1 IoCs
pid Process 4120 WiseCustomCalla1.exe - Loads dropped DLL 5 IoCs
pid Process 4272 MsiExec.exe 4272 MsiExec.exe 4120 WiseCustomCalla1.exe 4272 MsiExec.exe 4272 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS7AD59C05E83E49AFBD6C74464061DABE_4_2_0_0.MSI 2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS7AD59C05E83E49AFBD6C74464061DABE_4_2_0_0.MSI 2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\7AD59C05E83E49AFBD6C74464061DABE.TMP\WiseCustomCalla.dll MsiExec.exe File created C:\Windows\7AD59C05E83E49AFBD6C74464061DABE.TMP\WiseCustomCalla1.dll MsiExec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WiseCustomCalla1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1052 msiexec.exe Token: SeIncreaseQuotaPrivilege 1052 msiexec.exe Token: SeSecurityPrivilege 4496 msiexec.exe Token: SeCreateTokenPrivilege 1052 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1052 msiexec.exe Token: SeLockMemoryPrivilege 1052 msiexec.exe Token: SeIncreaseQuotaPrivilege 1052 msiexec.exe Token: SeMachineAccountPrivilege 1052 msiexec.exe Token: SeTcbPrivilege 1052 msiexec.exe Token: SeSecurityPrivilege 1052 msiexec.exe Token: SeTakeOwnershipPrivilege 1052 msiexec.exe Token: SeLoadDriverPrivilege 1052 msiexec.exe Token: SeSystemProfilePrivilege 1052 msiexec.exe Token: SeSystemtimePrivilege 1052 msiexec.exe Token: SeProfSingleProcessPrivilege 1052 msiexec.exe Token: SeIncBasePriorityPrivilege 1052 msiexec.exe Token: SeCreatePagefilePrivilege 1052 msiexec.exe Token: SeCreatePermanentPrivilege 1052 msiexec.exe Token: SeBackupPrivilege 1052 msiexec.exe Token: SeRestorePrivilege 1052 msiexec.exe Token: SeShutdownPrivilege 1052 msiexec.exe Token: SeDebugPrivilege 1052 msiexec.exe Token: SeAuditPrivilege 1052 msiexec.exe Token: SeSystemEnvironmentPrivilege 1052 msiexec.exe Token: SeChangeNotifyPrivilege 1052 msiexec.exe Token: SeRemoteShutdownPrivilege 1052 msiexec.exe Token: SeUndockPrivilege 1052 msiexec.exe Token: SeSyncAgentPrivilege 1052 msiexec.exe Token: SeEnableDelegationPrivilege 1052 msiexec.exe Token: SeManageVolumePrivilege 1052 msiexec.exe Token: SeImpersonatePrivilege 1052 msiexec.exe Token: SeCreateGlobalPrivilege 1052 msiexec.exe Token: SeCreateTokenPrivilege 1052 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1052 msiexec.exe Token: SeLockMemoryPrivilege 1052 msiexec.exe Token: SeIncreaseQuotaPrivilege 1052 msiexec.exe Token: SeMachineAccountPrivilege 1052 msiexec.exe Token: SeTcbPrivilege 1052 msiexec.exe Token: SeSecurityPrivilege 1052 msiexec.exe Token: SeTakeOwnershipPrivilege 1052 msiexec.exe Token: SeLoadDriverPrivilege 1052 msiexec.exe Token: SeSystemProfilePrivilege 1052 msiexec.exe Token: SeSystemtimePrivilege 1052 msiexec.exe Token: SeProfSingleProcessPrivilege 1052 msiexec.exe Token: SeIncBasePriorityPrivilege 1052 msiexec.exe Token: SeCreatePagefilePrivilege 1052 msiexec.exe Token: SeCreatePermanentPrivilege 1052 msiexec.exe Token: SeBackupPrivilege 1052 msiexec.exe Token: SeRestorePrivilege 1052 msiexec.exe Token: SeShutdownPrivilege 1052 msiexec.exe Token: SeDebugPrivilege 1052 msiexec.exe Token: SeAuditPrivilege 1052 msiexec.exe Token: SeSystemEnvironmentPrivilege 1052 msiexec.exe Token: SeChangeNotifyPrivilege 1052 msiexec.exe Token: SeRemoteShutdownPrivilege 1052 msiexec.exe Token: SeUndockPrivilege 1052 msiexec.exe Token: SeSyncAgentPrivilege 1052 msiexec.exe Token: SeEnableDelegationPrivilege 1052 msiexec.exe Token: SeManageVolumePrivilege 1052 msiexec.exe Token: SeImpersonatePrivilege 1052 msiexec.exe Token: SeCreateGlobalPrivilege 1052 msiexec.exe Token: SeCreateTokenPrivilege 1052 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1052 msiexec.exe Token: SeLockMemoryPrivilege 1052 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1052 msiexec.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1052 2600 2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe 85 PID 4496 wrote to memory of 4272 4496 msiexec.exe 88 PID 4272 wrote to memory of 4120 4272 MsiExec.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /I "C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS7AD59C05E83E49AFBD6C74464061DABE_4_2_0_0.MSI" WISE_SETUP_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\2026-07-28_a3e282f3e33c11c8660d2695847417be_amadey_elex_smoke-loader.exe"2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1052
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 148A40A8CB45DF67785989219BB03924 C2⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\7AD59C05E83E49AFBD6C74464061DABE.TMP\WiseCustomCalla1.exe"C:\Windows\7AD59C05E83E49AFBD6C74464061DABE.TMP\WiseCustomCalla1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4120
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Wise Installation Wizard\WIS7AD59C05E83E49AFBD6C74464061DABE_4_2_0_0.MSI
- Size 12.8MB
- SHA256 81fbc9523ee244b0787b113fd30160e79f204f8552f8e0718693b0e01d09048c
- MD5 9d796177650f1ef755ea1e923267aa1b
- SHA1 04e34191e7742841e0fb20a0af2f4a112197441c
- SHA512 48dfaad349a9c4f3e824265727767126a626f37f3272b860d22b8bfd8e67f69d958a34bd9cdd1b4fbf6cca78efaa820aa5a93ee4191c9dd501c361b237f34cbf
- SSDEEP 196608:JRCRlxGVUnze3+Ng/eCz8OlhKErpHeDbTtJVtbgTc+pUaMOA7vTN1AUQOiqUCEYn:JcT9nKF/jwOlhjriPt1b+yOAVZiqUzE
- TLSH T19CD633067156C8B2C950153224375BFA8B216D23FA15DC6B9378BECD2CF23E119BA5CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\GLC4FF0.tmp
- Size 161KB
- SHA256 250914ecdebf4423bdf4839327bafccc4118b7b68a3be629bdb7f7f0a8574e92
- MD5 2cf644ed9933d8747f8513701c23d622
- SHA1 a89d522a8c032d5da8896e1e3e9634af471bd876
- SHA512 c95c20de0973c711c6402ba51fa5bb76050c6cee805dbf4427febe494acb989bf10e6794200a508309a37e2768862c33d664c797e5059b7373f3b85d50f075dd
- SSDEEP 3072:A3E2Z2T+1tHhDbVC0fa/mblMpIa+4IHuddsUFtlyR6J7oo/GZxmmxe:BGc8tBDbE0faO5ye4IHadvQRmGZoI
- TLSH T19BF36C1E7554A23AC9E3803D20746B329BFF59341356B5D3DB209AE67DE0AD2AD38307
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4E98.tmp
- Size 18KB
- SHA256 be4002550e6f8f13ee7f5090c8412ca6bd316bbc7cf629bedbe739ee9684fec5
- MD5 79a33f753f72e80c583fcf81f1b8db85
- SHA1 f7da2691e6d114474c323f4b32d9c4233ba3f64f
- SHA512 792ba287757766787d447f7601e9c0962c4574b18c5fcdaf8e1cc5af4ff323da66b9b78adc430d422dff168c99d8d5fb7e99c958a2529fb5548c40d4afdf3a2b
- SSDEEP 192:mg546U+S/CdRZ/tvGf/9+gWutprj73kSnq8f3CKqDdagtcplI21pw:mX+wURZ/xg9+5utZX1nq8PWfcplI23w
- TLSH T1FC82B3163B1399B3C1DD4C74313B0436ABB68C3ADCA8A897EF5FCC5434A8392652BD16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI538C.tmp
- Size 108KB
- SHA256 cfae900920871f92cb9ab92a1732aeb7b0734464f33390dab49a193d4ae2a451
- MD5 91315b4c9aae41d5d5ecb33225c485e0
- SHA1 56b5f9bd3b8c2f3e46f4d75ecfedd0e3e27e8c17
- SHA512 7419942b34ef561a9834ea449242f34907b53db7472268f037c395100b88b95c8d9bd50635637f3cdafb6caa7721560458f567fba97bf1b659d13f1dc6334762
- SSDEEP 3072:txIKzIPKNvY9QkzbdmXhRS3W6Xb6WrXoJeG5JgWPcLH:7lNvYEfCW46WrXGa
- TLSH T1E7B39E83B3E580F1F956187C1567573B8A3BB41D852D9E83AB60FD046FA1382B7983C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\7AD59C05E83E49AFBD6C74464061DABE.TMP\WiseCustomCalla1.exe
- Size 108KB
- SHA256 57b60abe2d96cab8751a64ec92ecbf86ab3b944159f2e703891adca502f23e9d
- MD5 ad30b1f1701a8824f25181b837c4d972
- SHA1 51b9cd66959463bd16935b3a53ac69ae6ac73da1
- SHA512 bff10c9b2d2a527e45537624f3a89da4990526a70399417cd6a6f751e97b7763c3c41b645eec12aa82c24acdebee46ca479eaaf71f741e6d7b9aaaa74a52119a
- SSDEEP 3072:wCh9EW6eKIz3y9y1EksLQL4XnPpZ6b6xrJoKi2K:wCOILQ98L4XneB
- TLSH T1A7B3012E85A05D92F41404B23F737747EAB5E73019358AFF9191DE98AC342EE6B1282D
- MD5 SHA1 SHA512 SSDEEP TLSH