96ba1d163dc95656a10c2587ebb207f385d37941b78708f75db5f638f39c42b9

General

Target
2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
Size 2.5MB
Sample260905-k2drws1dkf
SHA256 96ba1d163dc95656a10c2587ebb207f385d37941b78708f75db5f638f39c42b9
MD5 626061a3bf2968f3b048c9f245209854
SHA1 01e35d3a972fc896e3e522e8910de192be37fca4
SHA512 321a849ea3d4176bef528696db288d677534c0916953c868c75b91cf45fc376c6db0ccedab34e3ccf566454b3fa35cd6fb8c65c47267e6d99de0596f5491f65d
SSDEEP 49152:MMDRZ9IBVL+s0ezJGd80SHMsThF35Hj1BzurmLkSZ+:MMDtIXLr06AdfEThF35PzurmLw
TLSH
T136C5231336E1C432D98604B20CD78AB91376FD604B64A9DB67D13E9D6EB23E33629385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4492	2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
4708	maintenance.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5944	cmd.exe
236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3356	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2508	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4492	2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 5944	1080	2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1080 wrote to memory of 236	1080	2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 5944 wrote to memory of 3444	5944	cmd.exe	93
PID 236 wrote to memory of 2516	236	cmd.exe	94
PID 5944 wrote to memory of 2508	5944	cmd.exe	95
PID 236 wrote to memory of 4492	236	cmd.exe	96
PID 236 wrote to memory of 3356	236	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe2026959531434.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /delete /tn "Maintenance" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3444
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx2026959531434.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb2026959531434.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-04_626061a3bf2968f3b048c9f245209854_amadey_elex_emotet_nymaim_rhadamanthys_smoke-loader_stealc_stop.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4492
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3356

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zb2026959531434.bat

Path C:\Users\Admin\AppData\Local\Temp\zb2026959531434.bat
Size 920B
SHA256 9701593c73c0725924d00c4340fccc81ea1e548b92df6f014134d1589a04a79d
MD5 1a771ad58f7625b50086c819e1314602
SHA1 4113b1db0b53501c67ed3992a9939654342e33ae
SHA512 1a1679976371b5209c13942a8e9d222f33135563ae431c9d40963909d3c925749fae4392772f60070e208870fe8393a0d872faf3dc2af46d5a289b7380afa8d3
TLSH
T108117D89815BCF3E0006E06F17F67C4DC0A929582A4133687E20E56D65D745DFEA3642
MD5 SHA1 SHA512 TLSH

Submit Download

zbe2026959531434.bat

Path C:\Users\Admin\AppData\Local\Temp\zbe2026959531434.bat
Size 420B
SHA256 0efc3fed08c37f96f60752282827137fbafa827b8db4a4225ef709c073ea165b
MD5 796ed9f05e4e253dba2f468437698a3b
SHA1 322487a0aadbc795e2db2d9ee4ab0ae3924a363e
SHA512 916f688fcbbceb31ec101d458eeac270043f9943ae7fd3791a36b48955ff12b88109d940e9aa019759b0e5ee5386cc35ae313754aaf7adbbd89c383dcecc7235
TLSH
T126E02301260BC2D06C48F86376830B05943018BC13C136283496583C41EF20FF455A03
MD5 SHA1 SHA512 TLSH

Submit Download

ze2026959531434.tmp

Path C:\Users\Admin\AppData\Local\Temp\ze2026959531434.tmp
Size 2.5MB
SHA256 a5bac23edc5a4ec3b23a4b2239a6d3afddb238a924345d7fb3484cd1f3c4d675
MD5 9d9e493923d8b5b30def03d4ac05813c
SHA1 c6953c099bfe69f370024d6bf27eea7e585a20b6
SHA512 863c89e86a9672eb826054e4a1a5fb8d8e4ca7f70da4077e3e185e1b1684aa57ca6a7785012713a6453711145d3d7395c58ccd7b60fbe8c04ecfe815de599ff5
SSDEEP 49152:HmLkSZ9UYWHsiJNXvkUKm/FPdGuHCGeQCAqXoZWHHAz+Sx+WysjwCgOJ/j/nAE:HmLcVHL/DKmFfCVQ42+SMWNxJ7/nAE
TLSH
T1F1C5232238E2C832D616047548EB8F7AB176BC008B5581C77BC1BF9E9DB27D36939647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zx2026959531434.xml

Path C:\Users\Admin\AppData\Local\Temp\zx2026959531434.xml
Size 1KB
SHA256 3da61a28d34c96d09e7a0fb2f1696bcc0396b335900f2572256f692f9e6e6e88
MD5 48eec625d7bcda9a6b80163e3d320e0b
SHA1 86ae7735602c364572a8504406a2d0a26b5a762a
SHA512 97f47981f81d212a0ef3369a6ae1339af60b611082e967dd5fcd9689311f408d12e3472cebf1c2174a549753bfa7d84631bd750cefe15b8d5797919daae6ea02
TLSH
T19131E3589CC0F72BB533922BE7515282EF758393456A4028F4CC4B7B1FF51466153563
MD5 SHA1 SHA512 TLSH

Submit Download

maintenance.exe

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
Size 2.2MB
SHA256 a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae
MD5 73ad6d009f1c53c23f5d068caa805299
SHA1 f50493f49c3b2b3697b5eb571738dbc70383cac0
SHA512 1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920
SSDEEP 49152:uo7TN6XYwGRV1LCnO9DivWp1daCCN2eLF6I5YDPRrBdSm2610V+9dmhBafgE:uC6NIDLCCiO/dat6I5YPFBx0VmKafgE
TLSH
T184B5337F996640A6FEB86ABC24127F7C892BD12703306D71D9D59C37045E223AB324ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PrinterInstall.log

Path C:\Windows\Temp\PrinterInstall.log
Size 1KB
SHA256 aa993c01860c442c83c983dabe576bf3130532b65501105c439d385eb2c4de08
MD5 fd044ceb873ace5221187af8442aca35
SHA1 a911ad6220c2a5db2fc540a9edc19aa239781f41
SHA512 0947071d82498675484c9fad915d61913ce82f3cb24d0ac61119f6423982a411045a8abb2743929757153479b2251f21a3a1ca5c8d8e5700ee072bfc44c2fa64
TLSH
T183317C05EB77899A1B3096131D0F66ABCF970D1A4702E3383B11CE583A1528E6DE4BD2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads