Overview

overview

6

Static

static

3

2026-08-02...ee.exe

windows10-2004-x64

6

2026-08-02...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    134s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 05:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_8486669db7d0801242aa2e5ea14e7d2c_elex_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.6MB
  • Sample260802-gm8ryadh95
  • SHA256 84c32ff275ec9d5495632659499683cc7dd2fb1fa25afde815bbda4f55db64c1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 33 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8486669db7d0801242aa2e5ea14e7d2c_elex_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_8486669db7d0801242aa2e5ea14e7d2c_elex_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4568
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8486669db7d0801242aa2e5ea14e7d2c_elex_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-02_8486669db7d0801242aa2e5ea14e7d2c_elex_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:5824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Embeddedd3dcompiler43.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\Embeddedd3dcompiler43.exe
        • Size 9.1MB
        • SHA256 d4ae3c82b80e52fe08b1cc0dc686f00ab750f1fefc061b5ff6c15b9b090c7b42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCChromeNativeMessagingHostCreate.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHostCreate.exe
        • Size 1.7MB
        • SHA256 a61427062acf420220caa0097a123b8cd891b06a71ea2406b942f39591868f5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudt58Runtime91.603136.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt58Runtime91.603136.exe
        • Size 1.6MB
        • SHA256 892a24cd92fde6997256b9ace03959ae0db8f1fb923c727ac81e17e0f2934014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jauregPlatform2.8.381.9.exe
        • Path C:\Program Files (x86)\Common Files\Java\Java Update\jauregPlatform2.8.381.9.exe
        • Size 1.6MB
        • SHA256 96b10f6e87a496a15b2eab5ce5ade15210eff913d2f17b3a26a42c873cf931a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Utilitiestelclient.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Utilitiestelclient.exe
        • Size 1.7MB
        • SHA256 c256ec2858b7650b8cf4f6eef823dddbd0edb2be1cefdd5bfd78a9343f5b1053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ManagementFramework.exe
        • Path C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\ManagementFramework.exe
        • Size 1.6MB
        • SHA256 79298cc4edffa6af3f15299751a31a837c6d2b166803b4cfe17d8fc9ecdf3cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CommandsPowerShell.exe
        • Path C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_en_31bf3856ad364e35\CommandsPowerShell.exe
        • Size 1.6MB
        • SHA256 c14045af10a3417910b82fd71a6f96468667dd33b649211fe1f3977b379c2f05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download