82a4a2243cce2bf00bcbcdc0c5cf06463ff4d2cd9a3310ecb64125f3d7d3e70a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_a73f98135d13abdec952eca73945f5f7_amadey_elex_smoke-loader_stealc_stop.exe
Size 821KB
Sample260811-2b72gsha67
SHA256 82a4a2243cce2bf00bcbcdc0c5cf06463ff4d2cd9a3310ecb64125f3d7d3e70a
MD5 a73f98135d13abdec952eca73945f5f7
SHA1 bf4cd4ae3a547500c8eb5fc5bc523a3e672c0107
SHA512 74e87c71a4a49997cbb92da4e70b49cc12991a8803d8502b4e83316758586e04770877702203a8e861d95876712c19dc1ceeb08fd7b725e31ed830c4516dd2cd
SSDEEP 12288:Yia0R2DdYa+JFeaUTN8KwLuroZ3cAXp/q8fjTUAdLCngRd6SfQ+cNwYV:YinRCMCaU9EZ3cAXp/qwnzqIDcNws
TLSH
T14605F12133D4C172F0BB27381CB6E7769B76BC601A31D65BBBC42B1D6E303919662762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
5792	2026-08-11_a73f98135d13abdec952eca73945f5f7_amadey_elex_smoke-loader_stealc_stop.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-11_a73f98135d13abdec952eca73945f5f7_amadey_elex_smoke-loader_stealc_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_a73f98135d13abdec952eca73945f5f7_amadey_elex_smoke-loader_stealc_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5792	2026-08-11_a73f98135d13abdec952eca73945f5f7_amadey_elex_smoke-loader_stealc_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_a73f98135d13abdec952eca73945f5f7_amadey_elex_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_a73f98135d13abdec952eca73945f5f7_amadey_elex_smoke-loader_stealc_stop.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fpb.tmp

Path C:\Users\Admin\AppData\Local\Temp\{60B4CD91-A382-4FF4-ACF9-B1CAC0841A13}\fpb.tmp
Size 481KB
SHA256 b9335dddc341aea524cec8013de5e2d852ef51105202974585a481fd0c9895c3
MD5 31dd34ce565a732c85a6c46bd9643294
SHA1 a23455a8225a1491345eb2d3fc98e8cb8d1ae8ac
SHA512 d2a30f44e94e19272183c70985c077963b9a2bc1c48b93bf6875cc3693b65b4b6be952a32856667b7ff886f746539f8ae5ebd45e91bbee4abbf7a4a00e6ff437
SSDEEP 6144:66h9YgKRqunKEPPLI6w/m6wKSTBNu0aDKCLoOWyoIiRUf:Th9YRRqCPLIz+63STEDKYf
TLSH
T165A4070267F88929F1F33B7CBD7EAA980A767D90AD34D15E5760210E19B0790DA70B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download