Overview

overview

8

Static

static

3

2026-10-01...ee.exe

windows10-2004-x64

8

2026-10-01...ee.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/10/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe
  • Size 6.0MB
  • Sample261002-weshbatbjb
  • SHA256 009e03f6ba889ca4bb0350f6abb058692304b84bd4e05ffda8023cebab5b8115
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 9 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 25 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 10 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 38 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe"
    1⤵
    • Manipulates Digital Signatures
    • Modifies trusted root certificate store through registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\usb_driver\installer_x64.exe
      C:\usb_driver\installer_x64.exe winusb_generic_device.inf
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4228
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4340
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{a5f92f1b-b336-9549-9f87-1f110ef353bf}\winusb_generic_device.inf" "9" "438aca6d3" "0000000000000140" "WinSta0\Default" "0000000000000150" "208" "C:\usb_driver"
      2⤵
      • Manipulates Digital Signatures
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:644
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:1556
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:2340
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
        1⤵
          PID:4992

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              139ebeae3d8ebfe34996190e4d342621_864ddaf1-1968-4ead-9c86-62acd3ec3075
              • Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\139ebeae3d8ebfe34996190e4d342621_864ddaf1-1968-4ead-9c86-62acd3ec3075
              • Size 1KB
              • SHA256 2f8d34adb3a667e0c1265d01a57c5de624f72f30b5a6e4eb9f72bb02cf851a27
              • MD5 SHA1 SHA512
              Submit Download

              WINUSB~1.CAT
              • Path C:\USB_DR~1\WINUSB~1.CAT
              • Size 3KB
              • SHA256 0872835d2dc146fd22e1fd2f6f74821f904a6ade3a3532a3840f725966ca6f73
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              gpt.ini
              • Path C:\Windows\System32\GroupPolicy\gpt.ini
              • Size 127B
              • SHA256 07956deed8284ce2dc1ff98f4a0fc3776df4b2299f53fac42962fe6f8de39836
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              gpt.ini
              • Path C:\Windows\System32\GroupPolicy\gpt.ini
              • Size 127B
              • SHA256 14694dbee3897b6bd5aa596ebfd893e727179b67811920c174dc70e6eee8e579
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              WinUSB_Generic_Device.inf
              • Path C:\usb_driver\WinUSB_Generic_Device.inf
              • Size 4KB
              • SHA256 833fc21dd8a7dfd54789bf87e3202395f172dbb56e20908b6bd609ff535ed730
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WdfCoInstaller01009.dll
              • Path C:\usb_driver\amd64\WdfCoInstaller01009.dll
              • Size 1.6MB
              • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              winusbcoinstaller2.dll
              • Path C:\usb_driver\amd64\winusbcoinstaller2.dll
              • Size 979KB
              • SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              installer_x64.exe
              • Path C:\usb_driver\installer_x64.exe
              • Size 19KB
              • SHA256 11e818dc96aa544b5a0569ca54b914079ef93febcc4d7fce87c8ba2592bafde0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WdfCoInstaller01009.dll
              • Path C:\usb_driver\x86\WdfCoInstaller01009.dll
              • Size 1.4MB
              • SHA256 7a6bf1f950684381205c717a51af2d9c81b203cb1f3db0006a4602e2df675c77
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              winusbcoinstaller2.dll
              • Path C:\usb_driver\x86\winusbcoinstaller2.dll
              • Size 831KB
              • SHA256 ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1064-0-0x0000000000400000-0x00000000009FB000-memory.dmp
              Download

              memory/1064-48-0x0000000000400000-0x00000000009FB000-memory.dmp
              Download