a780b383e4ff08e07814faf6fe6d12d42b28b37f0535661a5cfbe908caa17790

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_76230299f0827ac99848643f4ed5eb6e_amadey_elex_smoke-loader_stealc_stop.exe
Size 594KB
Sample260808-dwhekagq5v
SHA256 a780b383e4ff08e07814faf6fe6d12d42b28b37f0535661a5cfbe908caa17790
MD5 76230299f0827ac99848643f4ed5eb6e
SHA1 fd9cb23847e69ada13184b7bc6a4ce9cc8be7154
SHA512 add8434687234502b0a289deceef509550a19d7ffdd7c59b2d84ed82c2b94d518d3a96cc313a7990e41b80074e91b8fdf61960e7c9f44684b529d643f9282c46
SSDEEP 12288:x3TD4DnRfwKl+g6bo/eeOt5P8IMm7ZDkdp9oCu/q7:5TQuKl+g6cCvPMogdpDuW
TLSH
T1BED4016135D1C031F2A31431ADB4DBB1A979B9355A32998ABB901B3E5F71AD3C73A303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2636	EWS_x64.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	EWS_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_76230299f0827ac99848643f4ed5eb6e_amadey_elex_smoke-loader_stealc_stop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	2636	EWS_x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	EWS_x64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2636	4136	2026-08-08_76230299f0827ac99848643f4ed5eb6e_amadey_elex_smoke-loader_stealc_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_76230299f0827ac99848643f4ed5eb6e_amadey_elex_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_76230299f0827ac99848643f4ed5eb6e_amadey_elex_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\EWS_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\EWS_x64.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EWS_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\EWS_x64.exe
Size 565KB
SHA256 6668e4fb8401e421ecad762e5c5ac1c3e830bf29b1054984875137460ab69be2
MD5 d2f478506bec3495cf501a97f0954303
SHA1 879bc889617a2f50890657531ecdbcf9409f6aba
SHA512 0a448463ddd86fc18a7cc2bd9df5cf571b8f8634d7d8ab3924155b9fa74d37433e09cba9314f8edbae69b9bf49b3472c954e2d7a3f4c9a970faf093cfa6e9beb
SSDEEP 12288:0NnrWOAfqqR2ha+Zn9FtmL8yYo0d/iDImV/i:0tWOEPOa+zFcL8yYVYV/i
TLSH
T17FC40527DAF100D8EAA28177E522512195713CB50B64EBA7135B37B62F322E2CE3D774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EWS_xSET.ini

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\EWS_xSET.ini
Size 1KB
SHA256 f244f566328cba377047aa32ee0b66eae0eb5877665c24a9ab61f9fbb962b17a
MD5 744d74943067dafe26c663cf8231da42
SHA1 d70a50511bbf5ba75e4ed49f01dd799cc65a899c
SHA512 3382e3b79fa3eab81b870dadf0d88fcdb5b59c22e35113a7ab90a677715fdb1c500f67cb63a4d7193fe77ba53feb63f5903761ca84baf06602c31fd59f938db3
TLSH
T11621E07B590D90EC403366ED2E9D40348AF73095D798A3CC972209CABDCC9AF56D3C50
MD5 SHA1 SHA512 TLSH