Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 12:26
General
- Target 2026-08-01_f3c5ec212ce4f43bbc0cc2e5a6e09853_amadey_elex_smoke-loader_stealc_tofsee.exe
- Size 411KB
- Sample260801-pl731sverb
- SHA256 d5e5564ebad87a2e361dd9eced7bcc6cd2db6ce268614b255566a25e6ea00e7f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_f3c5ec212ce4f43bbc0cc2e5a6e09853_amadey_elex_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_f3c5ec212ce4f43bbc0cc2e5a6e09853_amadey_elex_smoke-loader_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B5F8.tmp"C:\Users\Admin\AppData\Local\Temp\B5F8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-01_f3c5ec212ce4f43bbc0cc2e5a6e09853_amadey_elex_smoke-loader_stealc_tofsee.exe 56E48F6FE643FBECF6A6F6F790B317E7EC5AA9B3B62C663E06143F62754C08E16EDC22517675D47F4C4591191AF3684E645573D278960FE4CB326D47A242D4F02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2026-08-01_f3c5ec212ce4f43bbc0cc2e5a6e09853_amadey_elex_smoke-loader_stealc_tofsee.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-08-01_f3c5ec212ce4f43bbc0cc2e5a6e09853_amadey_elex_smoke-loader_stealc_tofsee.doc
B5F8.tmp
sist02.xsl
fb3b0dbfee58fac8.customDestinations-ms
memory/120-30-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-24-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-18-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp
memory/120-20-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-19-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp
memory/120-21-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-22-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-25-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-26-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-29-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-17-0x00007FFB756DF000-0x00007FFB756E0000-memory.dmp
memory/120-28-0x00007FFB333D0000-0x00007FFB333E0000-memory.dmp
memory/120-27-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-15-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp
memory/120-23-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-31-0x00007FFB333D0000-0x00007FFB333E0000-memory.dmp
memory/120-46-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-44-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-45-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-49-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-51-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-52-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-48-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-47-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-50-0x00007FFB75580000-0x00007FFB757E3000-memory.dmp
memory/120-16-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp
memory/120-14-0x00007FFB356C0000-0x00007FFB356D0000-memory.dmp