180a81d0e184fc245546e5f7fc39027736594f04299a08ce50977b13f84b64fe

General

Target
2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop.exe
Size 21.6MB
Sample260730-gff4ca1cmf
SHA256 180a81d0e184fc245546e5f7fc39027736594f04299a08ce50977b13f84b64fe
MD5 431fafa8c4989b5eadbe219630472902
SHA1 159b5707ada33591952a8b506623d9ae442dc9fc
SHA512 51174805bdc310a52628000dbc1d4b8065bdbd3b681d91e3b68dcaeca446ab72930ca00c6f0a389fea0fcca079f9ea156dbdf28f402e16916c32c4820813792c
SSDEEP 393216:kpT7JkeljkHvkaXw6L1JIJUCTHz8IImOhmAEtCg3Q9ClGKkFC5SJn+3vU7aiEa3H:kpnJBljkPkaX3pJIZ8IInmAK3qCoKsH9
TLSH
T14C3733167A81C0F6E9F22671455A8729359075D40FB687CFE3DA03AD6FC90E60ABC36C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
256	SETUP64.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
256	SETUP64.EXE
256	SETUP64.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 256	4948	2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_431fafa8c4989b5eadbe219630472902_amadey_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\RemotePrint_x64_191JAUsHomeExportAsia\ECD\Data\Printer\Driver\WINX64\SETUP\SETUP64.EXE
  .\RemotePrint_x64_191JAUsHomeExportAsia\ECD\Data\Printer\Driver\WINX64\SETUP\SETUP64.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

epstplog.txt

Path C:\ProgramData\epstplog.txt
Size 7KB
SHA256 1f64fb91fd935f7f48ccd82cae720145a73dc517843cb43937f8c97de0406184
MD5 fc434d0903fc1f398d436c47468b8de3
SHA1 817b36b350f2f166c2c83a9ba6ad709d6821178c
SHA512 a738706d0f6986614c80b3470ad6823ea6aa7ed8bdfdcb9bcdb424acd7db9ca7c42b79f8c405e37e3a956c17aabc03961f67ae6398179b96b8e010507f22a2f9
SSDEEP 96:cYyBg8IZLMzoLTTqVHwZTLy7JEeX8IsJcq3:cT0LMzoLaVHOIqe8hF3
TLSH
T1C9F1AE3962F50D86E1AAC1A79DF3E1536736BDD23230DF0E43C6034D41AAE18A592B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.EXE

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\RemotePrint_x64_191JAUsHomeExportAsia\ECD\Data\Printer\Driver\WINX64\SETUP\SETUP64.EXE
Size 1.3MB
SHA256 6a797af5729b662d1237c7980c94f412a40552e85aa851b4d460f1c1a6cf5646
MD5 33f57caf4d3507032443f81ee8675b23
SHA1 97b2910fc4501fe5b651439589313a6688cdafcc
SHA512 9c645fe54555a6b03685926db4725af7cf3ca32b498f0a0f573f35c98cfca03d6d3643ace8348770bb001bdd9b3cc1a937d05c9755833a97766b79deda31e7b6
SSDEEP 24576:dJ6C4q9y5d1niVDfioDhLFSm7Q4xdM/fuFWsp5zVY3Z78o7M:aCHqd122GfS78dU25zVYJ7B7M
TLSH
T1F0555D16B6AC40F9E067D17AC622D66AE6F178421F3487CB4150CB5E2F7BAE18D39331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETUP64.dat

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\RemotePrint_x64_191JAUsHomeExportAsia\ECD\Data\Printer\Driver\WINX64\SETUP\SETUP64.dat
Size 613KB
SHA256 ce46020d2be4cd59d91f66237ea97e56e239d9892e65ff0a54624737245cf1c7
MD5 c6f6a98383c7f9b1e5af52388813069b
SHA1 6b9dc1ab0148fc1ef12d4e8394c1c84bea7db561
SHA512 d84912e85bba017a65ee465d37aab4843ef7e9b238f9c50eb8a08f199499b4ff050b29cd45c4e8e2962ab6e83c7b6974c61aee0c3764db6381a4e731be5d9d46
SSDEEP 3072:xpEtDmcQpOZ7IVMDj5PgcWX7A42IFSMq0hICNs5sP8YMpJqskYj5r5zeFrl7xSdg:cdk45URcQK45iC+Q+CCje8u
TLSH
T10BD4A10756F94215F2F79B00E8B00A724677BD5DAB3CD30D89C21D4C2AF5A9095A2BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

epsetup.eif

Path C:\Users\Admin\AppData\Local\Temp\WZSE0.TMP\RemotePrint_x64_191JAUsHomeExportAsia\ECD\Data\Printer\Driver\WINX64\SETUP\epsetup.eif
Size 79KB
SHA256 362f951c030171f672e8f1a0efead2f7f3713598cce363ccb5d222cc179a0bb6
MD5 64b077f58afe5a84748cf275b3600f40
SHA1 038a2a51043e5e3cf77b6b3527718c30de6b782a
SHA512 0013b761babf39bd2e3e31afc6be9c2efbfe7710d5d2f794605c75977f5d91faad8c4c1325a355a1174a4b648c21a8e7eab88523e2d2b0144b4a290d7756596d
SSDEEP 1536:TKyeVF3b3hW+o+HrUTUpGoYoDd4c8tm84DYrJM:TQF3b3hW+o+HrUTUpGoYop4c8tm84DF
TLSH
T19F837C02A3FE0108F2F3BB40DEF489A64A277D556A3DD51E09C14D4F16F4D909AA2BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E_WF10BE.CAT

Path \??\c:\users\admin\appdata\local\temp\wzse0.tmp\remoteprint_x64_191jaushomeexportasia\ecd\data\printer\driver\winx64\E_WF10BE.CAT
Size 25KB
SHA256 387ae92ae8dc68ce0a55cd10830be101a61a8c818f484d312c75a062f2aa52e9
MD5 4c5672ddda8d93f0c8e6d3cc2e355411
SHA1 3b658a071a229367ed430b3c01d781233605c810
SHA512 9bc9be0fe214bb17dde6f76569fc5fac2228e23af1b8414dcff8c69a2350cd0b2081b47e22260a311ef995a59e1570e8cc9a4ee7f9c3433422674ecf7e063c55
SSDEEP 192:sTdti1I4q0g0Mx7Xrj6HSLClsm+EZdHWPDEW6rLIRpJMXiu3ZFLdRFztyU6zExyE:sZPMXoQ3PQeFRTP3U0R9zNAo2Q9
TLSH
T1B3C2557D19ED02D3A05AC4B38FD6E0AFF435AA5BE8045A7D30DF77A04682241BB49D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e_wf10be.inf

Path \??\c:\users\admin\appdata\local\temp\wzse0.tmp\remoteprint_x64_191jaushomeexportasia\ecd\data\printer\driver\winx64\e_wf10be.inf
Size 9KB
SHA256 55c5aca84445a9e049052437fc1abd4633a6844e9809c84b08a043945052c325
MD5 a765df7f390540796232b3df8f85d52d
SHA1 0c166b9368accc963f5b923b6d8a0d2d12c28780
SHA512 08e4266456b5e05a5f27c7641971ea2cbebf1110fb6787310d5feea441d1e0018a897b17d4545243888c690c93daa33917d1799785397a00a71b7fa8ed3ca036
SSDEEP 96:hJaKPJX5eqW2lfTOCuHmuwRddn72ZOPs1055sROioeb/PqysOp+e/hgese:hQK2qW2lZ9y055AOil/Pqw5pse
TLSH
T14922D213B9EC320875A3AB814FE5C07B5713B894963D832E15E64B4FABE2C154606BF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads