Overview

overview

6

Static

static

3

2026-08-06...ee.exe

windows10-2004-x64

6

2026-08-06...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    129s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 00:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_e2653b79103275990a09ac44fb6998e7_elex_smoke-loader_stealc_stop_tofsee.exe
  • Size 713KB
  • Sample260807-affz1stekf
  • SHA256 0990b5df78a45232e66637ab3d6da76b86c4c89c164f10341b595d909735bb55
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 7 IoCs
  • Drops file in Program Files directory 43 IoCs
  • Drops file in Windows directory 45 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_e2653b79103275990a09ac44fb6998e7_elex_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_e2653b79103275990a09ac44fb6998e7_elex_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4084
  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_e2653b79103275990a09ac44fb6998e7_elex_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-06_e2653b79103275990a09ac44fb6998e7_elex_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:6140

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ChromiumDirectX.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\ChromiumDirectX.exe
        • Size 787KB
        • SHA256 97a3f1be78b335b212978104ca12a5dfe2ae7713738aad8a8ff135c391ede12c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ViewerPSLibrary.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ViewerPSLibrary.exe
        • Size 716KB
        • SHA256 317a0e3b919cc6d84407a7bbd9011888e7e1b146e7faecefda301458b190fbb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcrobatAdobe.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\AcrobatAdobe.exe
        • Size 715KB
        • SHA256 133c7195e48fb5c3f32466764c7152127ba80a857da43284da93d4438a8b9103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jauregUpdater2.8.381.9.exe
        • Path C:\Program Files (x86)\Common Files\Java\Java Update\jauregUpdater2.8.381.9.exe
        • Size 690KB
        • SHA256 e6e088b126566d1126d4ed06db6bb83ce28e024a05de5d1b3ecaf7a93b1abaf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msinfomsinfo.exe
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfomsinfo.exe
        • Size 713KB
        • SHA256 0990b5df78a45232e66637ab3d6da76b86c4c89c164f10341b595d909735bb55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dexploitationSystme10.0.26100.1.exe
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\dexploitationSystme10.0.26100.1.exe
        • Size 715KB
        • SHA256 79a1a3dd544493ac11db9860718886b468e06d794718cce5bd86c5f641888255
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaStart.exe
        • Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaStart.exe
        • Size 747KB
        • SHA256 3f24df8f610eec1f689615ff3149737ed0e43678c06add1da14d3532a2dcd6f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Systemmsaddsr.exe
        • Path C:\Program Files (x86)\Common Files\System\msadc\de-DE\Systemmsaddsr.exe
        • Size 715KB
        • SHA256 1938688ac140d540e97118c991890d1a786d43fdd9ec1772eec3c4b03b866074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        imjpdapiOperating.exe
        • Path C:\Windows\SysWOW64\IME\IMEJP\imjpdapiOperating.exe
        • Size 1018KB
        • SHA256 baf69af93e650e632ab41fcadee6d79c43d02ec05521438dfa4ee84c62b36fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download