61690d10685725a36306f22ffdf5989886e035dc1a11f655bb418f237cbc4e87

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_d279949ab8b174d0736acc696b407e24_amadey_elex_smoke-loader_stealc_stop.exe
Size 593KB
Sample260808-c5hagsgk21
SHA256 61690d10685725a36306f22ffdf5989886e035dc1a11f655bb418f237cbc4e87
MD5 d279949ab8b174d0736acc696b407e24
SHA1 ecc295fed29c48a7d0a11c7ed77655e89363bb15
SHA512 1ff9e7eb568dc8cf528a50d708f30dfcbef1fb43046a5041046c5f0764e933ca3134ac3ec9d0136bba8fb19590876b72c4f975b53f5e8f517d00a8ca218f5dbe
SSDEEP 12288:d3TD4DnRfwKl+jbo/eeOt5P8IMm7ZDkdp9oCu/q7:VTQuKl+jcCvPMogdpDuW
TLSH
T188D4016136E1C031F6A31431ADB4DBB16979BD345A329A8ABB901B3D5E71AD3C739303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2300	EWS_x64.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	EWS_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_d279949ab8b174d0736acc696b407e24_amadey_elex_smoke-loader_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	2300	EWS_x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	EWS_x64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6648 wrote to memory of 2300	6648	2026-08-08_d279949ab8b174d0736acc696b407e24_amadey_elex_smoke-loader_stealc_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-08_d279949ab8b174d0736acc696b407e24_amadey_elex_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d279949ab8b174d0736acc696b407e24_amadey_elex_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6648
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\EWS_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\EWS_x64.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EWS_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\EWS_x64.exe
Size 565KB
SHA256 6668e4fb8401e421ecad762e5c5ac1c3e830bf29b1054984875137460ab69be2
MD5 d2f478506bec3495cf501a97f0954303
SHA1 879bc889617a2f50890657531ecdbcf9409f6aba
SHA512 0a448463ddd86fc18a7cc2bd9df5cf571b8f8634d7d8ab3924155b9fa74d37433e09cba9314f8edbae69b9bf49b3472c954e2d7a3f4c9a970faf093cfa6e9beb
SSDEEP 12288:0NnrWOAfqqR2ha+Zn9FtmL8yYo0d/iDImV/i:0tWOEPOa+zFcL8yYVYV/i
TLSH
T17FC40527DAF100D8EAA28177E522512195713CB50B64EBA7135B37B62F322E2CE3D774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EWS_xSET.ini

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\EWS_xSET.ini
Size 1KB
SHA256 f244f566328cba377047aa32ee0b66eae0eb5877665c24a9ab61f9fbb962b17a
MD5 744d74943067dafe26c663cf8231da42
SHA1 d70a50511bbf5ba75e4ed49f01dd799cc65a899c
SHA512 3382e3b79fa3eab81b870dadf0d88fcdb5b59c22e35113a7ab90a677715fdb1c500f67cb63a4d7193fe77ba53feb63f5903761ca84baf06602c31fd59f938db3
TLSH
T11621E07B590D90EC403366ED2E9D40348AF73095D798A3CC972209CABDCC9AF56D3C50
MD5 SHA1 SHA512 TLSH