Overview

overview

6

Static

static

3

2026-07-31...ee.exe

windows10-2004-x64

6

2026-07-31...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    136s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_652b9b9a183927a1b9b9eebb417a5066_amadey_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
  • Size 912KB
  • Sample260731-wp25hadm8x
  • SHA256 ad8cc864308d142773617492ffd57aabecb170a696fad46004024a8cc7e7f27e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 47 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_652b9b9a183927a1b9b9eebb417a5066_amadey_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_652b9b9a183927a1b9b9eebb417a5066_amadey_elex_remcos_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1728
  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_652b9b9a183927a1b9b9eebb417a5066_amadey_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-31_652b9b9a183927a1b9b9eebb417a5066_amadey_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3192

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        libceflibGLESv2.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libceflibGLESv2.exe
        • Size 8.3MB
        • SHA256 1faedd4c2d0df81dc818ae4c8a5db4ece556c73a9b6392d522fb2955ee6a6985
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LogTransportLink.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransportLink.exe
        • Size 886KB
        • SHA256 ef144fa8f52ac50d79c7e01b50237002143a60f0448b52e2044bda6fa31e51fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdobeAcrobat.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AdobeAcrobat.exe
        • Size 914KB
        • SHA256 2aa5c11abf94586bbda82acef274e8377168a158823450e3f8088f7d221c6f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UpdaterAuto.exe
        • Path C:\Program Files (x86)\Common Files\Java\Java Update\UpdaterAuto.exe
        • Size 871KB
        • SHA256 e8f6ba72c0c345e998f100d9f5eea8f54a66565fd89a388521befe000c647ae5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOLoaderUIVSTOLoaderUI.exe
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUIVSTOLoaderUI.exe
        • Size 914KB
        • SHA256 204c8561ee082e52f4796fca4493df053fe370c230e4891213f0f1800145199f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VisualMicrosoft.exe
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\VisualMicrosoft.exe
        • Size 889KB
        • SHA256 fecfd29883f89d548f0361d9fbfa8205fccea4067b968f5a8130ca4ea6d45c3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdge.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\MicrosoftEdge.exe
        • Size 1.3MB
        • SHA256 3e838789ff14ff0bca2973173b721fa7f77035d9a1a577e0fb1d8ab5754d2d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mspdfdllwdag.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\mspdfdllwdag.exe
        • Size 1.2MB
        • SHA256 588a0527e13a3ad1189a28a3b6c6d8d72324b778dfb2fbd210ff807adfa268fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Updatemsedgeupdate.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Updatemsedgeupdate.exe
        • Size 958KB
        • SHA256 f665d3b6b7279c28b52cd27bbf641082009580952e03976e39b30db15c796774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OperatingWindows.exe
        • Path C:\Program Files (x86)\Windows NT\TableTextService\OperatingWindows.exe
        • Size 912KB
        • SHA256 ad8cc864308d142773617492ffd57aabecb170a696fad46004024a8cc7e7f27e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download