bf4883dbc126c2cee2f013dc2fb4f8d0044a7984cc3f256c06e1ccece1d6fdda

General

Target
2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe
Size 228KB
Sample260910-edg7hser2t
SHA256 bf4883dbc126c2cee2f013dc2fb4f8d0044a7984cc3f256c06e1ccece1d6fdda
MD5 9edc87fdc7f0177d799375f43f9f9210
SHA1 ee13fea6abc9f105a5700b2598a9ff7ed9d7a08b
SHA512 8975e05d27248697101281937f944d8b16a7cacefc5671c82aae20f1591a75d84849925baaabc96181bd78602e0ab03dc895f4ef32387e11db26b70f3b9085ed
SSDEEP 3072:86jI9XJy7rfnj3WCW2EW5Q+Hu54Fx4xE8AN5HfL/5OlXVaTGRGdzJlkB62+UgUBy:fUZy4+OEXCBGdNlz2sL
TLSH
T14D349E12B7409079C88122B5015DA7361ABDADB2236416C3F39CABFEDF766D05A353CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 6 IoCs

resource	yara_rule
behavioral2/memory/1080-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c488-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1080-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1628-15-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/820-17-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5108-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c488-6.dat	aspack_v212_v242

Executes dropped EXE 4 IoCs

pid	Process
820	MSWDM.EXE
5108	MSWDM.EXE
2820	2026-09-08_9EDC87FDC7F0177D799375F43F9F9210_AMADEY_ELEX_IPAMOR_SMOKE-LOADER.EXE
1628	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\devBFE0.tmp	2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe
File created	C:\WINDOWS\MSWDM.EXE	2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5108	MSWDM.EXE
5108	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 820	1080	2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe	89
PID 1080 wrote to memory of 5108	1080	2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe	90
PID 5108 wrote to memory of 2820	5108	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:820
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devBFE0.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-08_9edc87fdc7f0177d799375f43f9f9210_amadey_elex_ipamor_smoke-loader.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Users\Admin\AppData\Local\Temp\2026-09-08_9EDC87FDC7F0177D799375F43F9F9210_AMADEY_ELEX_IPAMOR_SMOKE-LOADER.EXE
    3⤵
    - Executes dropped EXE
    PID:2820

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 80KB
SHA256 c8906545cfade969ccead3d9259449110cf83e08029dad20dc50a189514b7b47
MD5 2968025160692126c940983172543c26
SHA1 0f978c5483d19416573b085f5d729fefc9c5bb73
SHA512 221f3753e0895c573ef5e68c941905a4e1b882e1346a83851822d0c244c3b353f4490a75579e4c07de79dfcc663c95e9368515795fbac10c62a4be88ef07f4b8
SSDEEP 1536:3STjtALMd6bE9XJuFrvJ70z+4YXnj3WCW2EW5Q+sdguxnSngBNpT/mzNnxPAxEA8:86jI9XJy7rfnj3WCW2EW5Q+Hu54Fx4xm
TLSH
T19483E066E70594E4EA8040304A278F7E0A35BD9B53505BE3379CFE0FAF7168499372AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devBFE0.tmp

Path C:\Windows\devBFE0.tmp
Size 148KB
SHA256 698c4e22332c331a8c2e3edc3d19afb8796897619d72ec30dd945782d7b9f18b
MD5 7d87aa4220e73cbf635d92944789a2fd
SHA1 a3a6e0e15517df0ae3dd84b8e809a4019734d890
SHA512 f6ecb24a013fd0302a005ddd1c4674832336364869adb37777d2a95d05d30b90462ee74dcef53481e3cf732e4a15fe3334e124ea1659946ad635a0881b278712
SSDEEP 3072:zN5HfL/5OlXVaTGRGdzJlkB62+UgUB2fgMI:EBGdNlz2sI
TLSH
T129E35C11B740903AC89222B9019CA7311EBDE9B1276411C7F39D5BFEDF6A6D05A347CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-17-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1080-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1080-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1628-15-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1628-16-0x0000000002040000-0x0000000002046000-memory.dmp

Download

memory/5108-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads