84d7721c52877eb52b8b35741122bfe40068428aba83e7026fcb8379d23e255a

General

Target
2026-08-03_83a0430094b297857c3c17cc153ad7ed_amadey_elex_konni_smoke-loader_stealc_stop_tofsee.exe
Size 272KB
Sample260804-m5761saa43
SHA256 84d7721c52877eb52b8b35741122bfe40068428aba83e7026fcb8379d23e255a
MD5 83a0430094b297857c3c17cc153ad7ed
SHA1 919234afcf4ef2132f8cc408107b242103bde94a
SHA512 cd63c86b4c91f72d7cc87f75286c87b53a23102be955010a86916cf5b0608e5641130e2fb545d40f64e0623817b781d5c5807656fc11d06b605a799926dd9868
SSDEEP 6144:Da4InuJg58BkgqPoDH49n8Bb/cg8hAodF3:Dat0EAH49n8Bt8SUF3
TLSH
T15454E66B00074760E7391770CE5975A394E839097CA7EAFFFED91A8205B91E9E06E730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

adware discovery execution spyware

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 6 IoCs

execution

Visual Basic

T1059.005

pid	Process
1856	WScript.exe
5988	WScript.exe
2156	WScript.exe
3428	WScript.exe
2640	WScript.exe
1284	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_83a0430094b297857c3c17cc153ad7ed_amadey_elex_konni_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	control.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3384	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5532	4920	2026-08-03_83a0430094b297857c3c17cc153ad7ed_amadey_elex_konni_smoke-loader_stealc_stop_tofsee.exe	89
PID 5532 wrote to memory of 3428	5532	cmd.exe	91
PID 5532 wrote to memory of 2640	5532	cmd.exe	93
PID 5532 wrote to memory of 1284	5532	cmd.exe	94
PID 5532 wrote to memory of 584	5532	cmd.exe	96
PID 5532 wrote to memory of 1856	5532	cmd.exe	97
PID 5532 wrote to memory of 5988	5532	cmd.exe	98
PID 5532 wrote to memory of 2156	5532	cmd.exe	99
PID 5532 wrote to memory of 2032	5532	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-03_83a0430094b297857c3c17cc153ad7ed_amadey_elex_konni_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_83a0430094b297857c3c17cc153ad7ed_amadey_elex_konni_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /IPK MHF9N-XY6XB-WVXMC-BTDCT-MKKG7
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:3428
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /SKMS 58.173.212.51
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2640
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ATO
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1284
- - C:\Windows\SysWOW64\mode.com
    mode con cols=1 lines=1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:584
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" -dlv
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1856
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" -dli
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:5988
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" -xpr
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:2156
- - C:\Windows\SysWOW64\control.exe
    C:\Windows\System32\control.exe /name Microsoft.System
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2032

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:4804

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Install.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Install.bat
Size 1KB
SHA256 56ec955cfec71aa9a7a7ec4c85aeeca19aae4ec5faa8d3e5d45257b460b04388
MD5 88758a25a72a89eab5f1da3a8b00dfb8
SHA1 0276baf8ad64337119cb689d70dd11f9bc20d729
SHA512 2776fa9244f9aed5b81e742548254766a9a7bd1d3cdf9c43dc36199ff067ec2d3e2eb70353ee2041218251918c3c45fb8532596e391ec8947f45770eb3816310
TLSH
T11131AD187562AC190BF6ADB60DB2E0CFAC1E424F9E934E1A714FB064C76F3D2B164841
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing