31d3e0702dab1658631cb76356b0725f3752c1bd841569b23888f5ce7e52b97b

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
Size 247KB
Sample260728-lyc7matfmc
SHA256 31d3e0702dab1658631cb76356b0725f3752c1bd841569b23888f5ce7e52b97b
MD5 74ac0ecdc8a1f85c1aec2793c277acc6
SHA1 02c9b34d951a3ed17c62a5b7294c074967fe7c9f
SHA512 691517b8070ddaa53766d53d45d93ac14e27fa157b8bd1cde1e76db2f84f46ac194c4d31b7abd61ddf1820ea03369159fedebd98721b39ff43fe4bd7559bf5e8
SSDEEP 3072:vQLWOnFiCnkIDSrySPnhl0Cj/irN833f+y7bQ6wvCIWf2JjBX+ZfBHyD:IACTD4Pbn3f+yfwKIW+fcfBHyD
TLSH
T12934F7BD2992FC3DD421C03BC96486F166686D28FD1E65D7A7E13E29353E9A2C31D203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3224	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3224	3872	2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_74ac0ecdc8a1f85c1aec2793c277acc6_amadey_elex_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.vbs
Size 83B
SHA256 b533ba1defae109c33613bc544a5deada6034da9330b08f1efcaccc865cefad3
MD5 693cee40150c73f7dc90cbb109f5ec3c
SHA1 a7aeda310daf5056707b7927661055105217027f
SHA512 700c12f903e80107ef3fcb0a9edc3d3d05fc796cb99c845836be1995c22885f145d563af1c8bb6eedc0a34e82c56c81aaff84260843439881c925ec29a3b8608
TLSH
T191A0128510DC95321A131143050BDDB0544C2002246108C5034228502459495A11D323
MD5 SHA1 SHA512 TLSH

Submit Download