Overview

overview

6

Static

static

3

2026-08-25...ee.exe

windows10-2004-x64

6

2026-08-25...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    133s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 13:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-25_af6aadc65a84dfe0b3f8c36e789dd9da_elex_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.4MB
  • Sample260826-qnnb3azdpg
  • SHA256 793a427711893a7c54b48d8e4d010b27987b4bdfafa6d07ab87c1b39d6e7f308
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 46 IoCs
  • Drops file in Windows directory 38 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_af6aadc65a84dfe0b3f8c36e789dd9da_elex_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-25_af6aadc65a84dfe0b3f8c36e789dd9da_elex_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4292
  • C:\Users\Admin\AppData\Local\Temp\2026-08-25_af6aadc65a84dfe0b3f8c36e789dd9da_elex_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-25_af6aadc65a84dfe0b3f8c36e789dd9da_elex_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3336

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ComponentsWebInstaller.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\ComponentsWebInstaller.exe
        • Size 8.8MB
        • SHA256 070faa1a5315f9696a506ee4c43eebacef6f339e0b001b0a3fd9af6d89a4e831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LogSessionahclient91.271639.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogSessionahclient91.271639.exe
        • Size 1.3MB
        • SHA256 92d52f7a093cae19c3ca2cf7ef4d463d4aaa765dcef396b08ecb5ab581129ae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        prcrLibrary.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcrLibrary.exe
        • Size 1.4MB
        • SHA256 2de03332fcdb96b653e1a42179a3fa55a6b1231ab51186bbd4d31d60d9dc7633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AcrobatAdobeARM.exe
        • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AcrobatAdobeARM.exe
        • Size 1.4MB
        • SHA256 38884bc9fb5174ef3f0e3a270e202fb60846f8589764fb25ee6c956b9260ff21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Platformjaureg.exe
        • Path C:\Program Files (x86)\Common Files\Java\Java Update\Platformjaureg.exe
        • Size 1.3MB
        • SHA256 0e605933eec014c9b45124b832d2fdb2c5a27d4583378e5581e7dd5e7aeccbf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdadcmsdaosp.exe
        • Path C:\Program Files (x86)\Common Files\System\Ole DB\msdadcmsdaosp.exe
        • Size 1.4MB
        • SHA256 793a427711893a7c54b48d8e4d010b27987b4bdfafa6d07ab87c1b39d6e7f308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ieinstalExplorer11.00.26100.1.160101.0800.exe
        • Path C:\Program Files (x86)\Internet Explorer\de-DE\ieinstalExplorer11.00.26100.1.160101.0800.exe
        • Size 1.4MB
        • SHA256 0777485c4d0c8877410899a6f46b6b9bf83b49ddd862e4d75a00a1b82fd7acc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PresentationFrameworkUIAutomationClient.exe
        • Path C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFrameworkUIAutomationClient.exe
        • Size 1.4MB
        • SHA256 5bb95205aea923f8445401cd9305a7eb853ddedf5de1112fd0dc7caf9d2b7cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershellgraphicalhost.exe
        • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\powershellgraphicalhost.exe
        • Size 1.4MB
        • SHA256 5b3087775c5c8d20c315b4d1a25fb363579446ce75ea2833b9c8b1cf9010639a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download