Analysis
- max time kernel
147s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe
- Size 6.0MB
- Sample261002-weshbatbjb
- SHA256 009e03f6ba889ca4bb0350f6abb058692304b84bd4e05ffda8023cebab5b8115
- MD5 29143b10b8f7d4ca7d0df554b9ef27c8
- SHA1 db42fa9f39e9f9a59f817cbc102a84f015b1a7e1
- SHA512 9ffd788b6cca61948cf870b523ce2e8afa67648200b7ce4601d6e4bf341bdf4088ac6e46c94b6419f93f9bdb8cacce3b1d17f2b0d6d4261f06d0a1ce84b98d71
- SSDEEP 98304:tJBtN0A0AZ4lBkCOXKojkzBAw7uirZ2ans8GVoLd+GnABc/lw++NU023W:94FECEhw7ui12ansBGdPnkctd+Np4W
- TLSH T1E4561220A3C48A74E2A34778D5B9F64D9634F8902775D0CF639886BC08F56C189FA79F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Manipulates Digital Signatures 1 TTPs 13 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 03000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d78102000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 03000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d7812000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 03000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd2000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 0f0000000100000014000000980b15c25076cc765243dbe60905181009b1cfe603000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd0b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe DrvInst.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e17202000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d7812000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 03000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd02000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd2000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e1722000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e1722000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe - Executes dropped EXE 2 IoCs
pid Process 4384 installer_x64.exe 2620 installer_x64.exe - Drops file in System32 directory 30 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy installer_x64.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini installer_x64.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI installer_x64.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini installer_x64.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_0f5d8f3fcbdebf20.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_0f5d8f3fcbdebf20\amd64\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_0f5d8f3fcbdebf20\WinUSB_Generic_Device.cat DrvInst.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol installer_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\WinUSB_Generic_Device.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\SETEFC6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\amd64 DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\SETEFC5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_0f5d8f3fcbdebf20\winusb_generic_device.inf DrvInst.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol installer_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\SETEFC5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\winusb_generic_device.inf DrvInst.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol installer_x64.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI installer_x64.exe File created C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\amd64\SETEFC7.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\amd64\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\amd64\SETEFD8.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\amd64\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b} DrvInst.exe File opened for modification C:\Windows\System32\GroupPolicy installer_x64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\amd64\SETEFC7.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\amd64\SETEFD8.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{ec85bdf7-babb-aa49-802c-4a96761a827b}\SETEFC6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_0f5d8f3fcbdebf20\amd64\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log installer_x64.exe File opened for modification C:\Windows\INF\setupapi.dev.log installer_x64.exe File opened for modification C:\Windows\logs\StorGroupPolicy.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 15 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 0f000000010000001400000066a5372da58f73b63ff91c3b5ff095d4d27002c10b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e0065007200000000000000000003000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d7812000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 03000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d7812000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 03000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd2000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd2000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 03000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d78102000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d7812000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 03000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd02000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 0f000000010000001400000017b76e68c781a766eeb12ebaf5704ef111c28e1e0b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e00650072000000000000000000030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e1722000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e1722000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 0f0000000100000014000000980b15c25076cc765243dbe60905181009b1cfe60b000000010000000e0000006c0069006200770064006900000002000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e0065007200000000000000000003000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd2000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e17202000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e1722000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe - Checks SCSI registry key(s) 3 TTPs 32 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs installer_x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID installer_x64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 installer_x64.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Colors 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe - Modifies registry class 60 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f49471a0359723fa74489c55595fe6b30ee0000 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\NotificationData 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 820074001c004346534616003100000000002b5d627c120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe2b5d627c425d518e2e0000007c000000000002000000000000000000000000000000b98623004100700070004400610074006100000042000000 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 50003100000000002b5d687f14004c6f63616c003c0009000400efbe2b5d627c425d518e2e00000090000000000002000000000000000000000000000000584dc0004c006f00630061006c00000014000000 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 4e00310000000000425d518e100054656d7000003a0009000400efbe2b5d627c425d518e2e00000091000000000002000000000000000000000000000000d20b1801540065006d007000000014000000 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f481cffcda87848be43b5fdf8091c1c60d00000 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (str) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe - Modifies system certificate store 2 TTPs 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 03000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d78102000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 03000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd02000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 0b000000010000000e0000006c00690062007700640069000000030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e1722000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 03000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d7812000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000004981d0d7c1c9509ac60d17863e6b06e2fa6d7812000000001000000c0020000308202bc30820225a00302010202102e89962240f737ab4b3c385cb96a3ea3300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034315a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100da73b940edb5c7858d99d2acb44346ae02e0d28c421becc208c959239926fd32d73b5307156532031eb1588f0e05c1811ba0adf2132c64a5a908a051288cd62f3c31b005e9c0e31ee3d71bafdafd5e40d921f0090a383a4f9f774dd0eb072bd32dae8147ee9be5b3d86fe81b7c0ed6040ef51520a01e1931f15b48e379b16ea10203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181003ae4f4316974a7dc82dd839f4d4d4a85fb64ff908863e6a06807e5afac31ba70d6cd1575b3958493b3eb4a42db911482f40b60e97acf285a0feeb6b9c002d4b2191f6611d460203c14581b8744abe06746c97e30f76623215d040cfc58c752788e1cf4a7cb6bad3286e9c5eddb84887e8d3554e0f8e5f0ea2de01d268c57532f 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 0b000000010000000e0000006c0069006200770064006900000003000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd2000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e1722000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\04981D0D7C1C9509AC60D17863E6B06E2FA6D781 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172\Blob = 030000000100000014000000df68f1c168815f44ef201cf742f2016774e3e17202000000010000004c0000001c0000000000000001000000200000000000000000000000020000006c006900620077006400690020006b0065007900200063006f006e007400610069006e006500720000000000000000000b000000010000000e0000006c006900620077006400690000002000000001000000c0020000308202bc30820225a0030201020210121eb0758bcf39904b6094209a60f3e5300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353231335a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100cc86f73424f668b6be16c0a3bb7dcc793db709186cced9a26ab97246fb3dab1cab097759a8c8da8fe8b548a4b7785f8264b252e0e761ed15df2ac0b574250eeee3927ad8aa2359c679df9b5d7b9c03d380d7ab299ff4bbea328673092646afcc05e159e1e0cdbe14ee06dd60c402bb3236e7db9f3af583a90c5bbe32befa2fd50203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d010105050003818100be760fd3d8aad30976232c226fd82b9650468643aa4c1b8406902484062345609852710d909516113a16fe27fdc53090cbf41126f56678a83d96b833ee060307b3ca218c9e80674171b836fe3204332118a46a502480478c9080e78e58ec0dbf1fcb271350a5993eb19ae0a725dea32ee9c63f4f69f01cf38adf36e0461715cf 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\94EA0CF02F6E1D4F706519B014A23A39A18CF4DD\Blob = 03000000010000001400000094ea0cf02f6e1d4f706519b014a23a39a18cf4dd2000000001000000c0020000308202bc30820225a0030201020210423a955e3a95f19c4f132a1441891e0c300d06092a864886f70d0101050500305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e0065007200610074006500640029301e170d3236313030323137353034325a170d3239303130313030303030305a305d315b305906035504031e52005500530042005c004d0053005f0043004f004d0050005f00570049004e00550053004200200028006c006900620077006400690020006100750074006f00670065006e006500720061007400650064002930819f300d06092a864886f70d010101050003818d0030818902818100c38e6b7422d5df9c45b97de2965dc786f55a63843084da6db81c29370ce1a614aeb7e78a2bb0a14732dce5722082613e0c1c25d63a294d6a93a2d0c224c6099cd4ca2bd1d5599d9f61236265cb513ab10ca24adbc4210f5ffcb033ed32545cbdfd7ca2203e24728050e6a75c31188a69040fd7e0c343a7ae602269a9a9f48a050203010001a37d307b30160603551d250101ff040c300a06082b0601050507030330200603551d07041930178615687474703a2f2f6c69627764692e616b656f2e6965303f0603551d2004383036303406082b060105050702013028302606082b06010505070201161a687474703a2f2f6c69627764692d6370732e616b656f2e696500300d06092a864886f70d0101050500038181009b1350851c999b72e88706eacc75320a9ede89f8897b9e1b9f7eca851f30e357aae98ae0ddc4744253e7d59e7f792192542855d1848e53cb3e455bbef986732fad359dcf7b92ea87e59f6a0183c90872b79b927d43797a391b7d27a923eece8bb707ebf80edb5ed800c9d9b9fda2ce6ffef1f2fd22f610fa2c6ef902032ed7fe 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\DF68F1C168815F44EF201CF742F2016774E3E172 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 2620 installer_x64.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1676 wrote to memory of 4384 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 89 PID 1676 wrote to memory of 2620 1676 2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_29143b10b8f7d4ca7d0df554b9ef27c8_amadey_elex_smoke-loader_stealc_tofsee.exe"1⤵
- Manipulates Digital Signatures
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\usb_driver\installer_x64.exeC:\usb_driver\installer_x64.exe winusb_generic_device.inf2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4384
-
-
C:\usb_driver\installer_x64.exeC:\usb_driver\installer_x64.exe winusb_generic_device.inf2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2620
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:5180
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
- Drops file in Windows directory
PID:5748
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{59059ea0-74be-fb46-a60f-d4dbf49b06c6}\winusb_generic_device.inf" "9" "438aca6d3" "000000000000016C" "WinSta0\Default" "000000000000017C" "208" "C:\usb_driver"1⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:5016
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\139ebeae3d8ebfe34996190e4d342621_71306956-741d-496c-97c6-468adc86abdb
- Size 1KB
- SHA256 2f8d34adb3a667e0c1265d01a57c5de624f72f30b5a6e4eb9f72bb02cf851a27
- MD5 76502b0b9c6bbfce11f217d2f62d458b
- SHA1 9c7a421cacc3b7235f8200dbd0b24d537745a8b4
- SHA512 9db4d43c72f09427db47664497d82d19f941c80cbf2766695a53e5b7c7585bce7e37d8ae2803877e92e198904aed3203b8c1dfaf814cc517d6efdb32bd297603
- MD5 SHA1 SHA512
- Path C:\USB_DR~1\WINUSB~1.CAT
- Size 3KB
- SHA256 16fbd17c21c006f967f115ee895d9e99b6ea582e591ce753e8daf8ee4d1ddb70
- MD5 110f69a278164b948cc6d7297fd16609
- SHA1 7c2c8dc7c85d5ddf2b8a3181b8dbd1f9b2623b78
- SHA512 51f0d17adeae3e0deb260b9b0d99b0ad0313df99309c3c3039ad91e57d4470ca1dcd2543b901dc5fc1f1084cb20ca7b30194799292a9ba789b13ac3e68a61372
- TLSH T1BA71343B06EE0166A167C9B25BFA705EF832EFA7E804593E20D737644941302B35E92D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\zadig.log
- Size 6KB
- SHA256 f1917c32fce724491f519793a10d211f80b81b3066780efa5ecfa9fda3ffc083
- MD5 b9aa4f6a67049338892232e81dc76060
- SHA1 5940ac91f316f7a20825774eb8be6397c988c642
- SHA512 ff7fdfe1ae31b89f7e2076f9ee1261774cf85ec9e90cacc0581d5546ace4bc272526b638c70fbd791f3f50b64a75c633c6d5518153b1cc61462dc96fd3672e33
- SSDEEP 96:2T+J4ywtljXr9s4ljXr94ljXr94ljXr9G+yFh:2T+J4ywtljXrDljXrmljXrmljXrI+yr
- TLSH T1FCD1FD12ADD64DE6F5F608C1451331B9E10C05A9B27AB073999F84ACBEEDB0D22DE712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\winusb_generic_device.inf_amd64_0f5d8f3fcbdebf20.ini
- Size 609B
- SHA256 9566eee919037eec5e28cfaade8f7515ae40db111c6e2873b24b12392d6b0dcb
- MD5 245abfe728e2473238bed87a0c888aef
- SHA1 566721741a650c2cd7352b630cb6cf91ff3c7b11
- SHA512 f23dd69b93a79fa8103621066eee1e18d308de9a59861fe76e107acbbb98d12034650f6a7d9e1607dc594170390fd56b16b6158be52d871dfa51ad3adb77590a
- TLSH T1F8F0289B4E62CAF9B0035A270B1D5C2C992D71EC4851A8EE7349CA808F0FD2CC7291E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
- Size 192B
- SHA256 f5aec4a8d9c019b74d4d77f25576739218a51c9c10b42da80283c53639c4c356
- MD5 3b5719be108e09d17cddbd23932fb5a5
- SHA1 faf4f477ff70ca4f7524be7f914e30e89eb00c03
- SHA512 d2c67cfbcfed25af5fa227d650ce42bc159c865ef458afc0f374e39fd70da38f881a778f40d6b9cdfd73e80164c977902d1724b8882ce35ee71202dfb6c8957c
- TLSH T1BFC04C400BF81A59F7FB0D727A3759455C7678162D01ED8C1268414D44B6E34DE7332B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\GroupPolicy\gpt.ini
- Size 127B
- SHA256 07956deed8284ce2dc1ff98f4a0fc3776df4b2299f53fac42962fe6f8de39836
- MD5 cead048a81341e7f91c31f96a82e98e3
- SHA1 32f24dda3c3774957c623df11c1237c36ded44fd
- SHA512 34c2887a34a65befe377822c93c662f26ace734b74628c77334d019f22633ecde948ceba29dad5d2b38685bfd90bbdc9817887f1f5a7bd4d3d68fbde38611a7a
- TLSH T1DBB02B1302400422C03B034040A8260491AC0008F17000F9F313D24FA782A205C7A851
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\GroupPolicy\gpt.ini
- Size 127B
- SHA256 a9f72eea0a53999ac1e062d934bafc601a7a1b9a00ecedc9efa54713d79aaf37
- MD5 b1247f4b88d54073cf6890171d98ba17
- SHA1 4836f5b8aed470b675b90b161bf238248bb26f02
- SHA512 2924fac567a8d929f4f27f79ce8d773c9108d8ea127f7a1de4cc445e1aa4ef602e5d438943c47a4011d45f9ad99073e01c99eb441658171e598b5816b68cbbd7
- TLSH T1D8B02B1302400022C02B034040A8150491AC0108F17000F9F313D24F9782A205C7AC51
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\GroupPolicy\gpt.ini
- Size 127B
- SHA256 14694dbee3897b6bd5aa596ebfd893e727179b67811920c174dc70e6eee8e579
- MD5 f9a49a3e2415016fa85ddff0b8b38419
- SHA1 f8c987119269e58d22a6b17ae2e8eca7744fb385
- SHA512 91ea129a51d2c3b342287c1250f5b0da6ba2a61eff11791d1cfae1f5c6dd2654c935be1452f4a681e794fd723a3c295e9bc9e59b9005aa4d8bd55ed36c9ad91c
- TLSH T128B02B1303400026C02B034040A8150491AC0008F17040F9F313D24F9782A205C7A851
- MD5 SHA1 SHA512 TLSH
- Path C:\usb_driver\WinUSB_Generic_Device.inf
- Size 4KB
- SHA256 833fc21dd8a7dfd54789bf87e3202395f172dbb56e20908b6bd609ff535ed730
- MD5 a85488f114981a689d4766ed541eaa98
- SHA1 d589c3835ebb6021975775c9af2ac8e202cc721b
- SHA512 787c76f7d725bed84d044cc3b0bd967aa59431c0382fdbecc9abd6a017ea228d0326602db7d81fccf4c91e31513c36dac638bfe26c514949fa9d1d29f83e454f
- SSDEEP 96:p/xvu3Ivwi1JEL5gHiW4Hab+TylacO6eZ:W3zL8+J
- TLSH T104919052ABE4161DF0F31B84F9F401B65E627C9A5C3C9A6C12E0610E2BF1E44D9B17B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\usb_driver\amd64\WdfCoInstaller01009.dll
- Size 1.6MB
- SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
- MD5 4da5da193e0e4f86f6f8fd43ef25329a
- SHA1 68a44d37ff535a2c454f2440e1429833a1c6d810
- SHA512 b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
- SSDEEP 24576:oU4MsColC6Je/ZgY7OOfcEpiRLH87SyVXGe38uKUj+NFVov1PJLfVKZ8F5mEeZWF:BFCsfZRZA6Xn388avVovfLd+Mo4iEF
- TLSH T10485234577FC1178F1F3AAB48ABA84062A767C854FB6D28F0250C95D6DB2FC489B4363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\usb_driver\amd64\winusbcoinstaller2.dll
- Size 979KB
- SHA256 981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
- MD5 246900ce6474718730ecd4f873234cf5
- SHA1 0c84b56c82e4624824154d27926ded1c45f4b331
- SHA512 6a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
- SSDEEP 24576:aAEBXzGJ7fW6hHv62VYeL7WCE3wixdLZWQzMjp:uBXQz/hPzxRwPdcO
- TLSH T16225124117A48478E4F2AB74A5FB8A11D770BC111735C3CF8285AAAC2E727D9DE38727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\usb_driver\installer_x64.exe
- Size 19KB
- SHA256 11e818dc96aa544b5a0569ca54b914079ef93febcc4d7fce87c8ba2592bafde0
- MD5 64aa8fd9bf7a5591459a77c257a597f3
- SHA1 07f86d57b81131b177d86e8d3982023f98336a4a
- SHA512 1b11b234f516bfd274c5cbebbc9c13ae4700062778e7c5d5014d291d9d05150dbd71c32dbe265e5669d0d15d2bb0ee9102053f3044464d274a6364565d9d1507
- SSDEEP 384:efeP4U7mTgzvIGYzqgK9CRCqHWdL+1y4i+FGlhAI2j:++7nvWe9CRCZS1r6t2
- TLSH T14B927C2353466FFEE427C179C5602923E9B27E9E1716724F0AA0E2590F720E2EE7D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\usb_driver\installer_x86.exe
- Size 17KB
- SHA256 f00dfcbcbf14a854a7b8e7a87ef3791a1eeee9e105f3f7a8bc87215e64324f54
- MD5 5def7d4cded141c34cb57f1195240403
- SHA1 d1e5c321343a03f1344b3d3ed6ec6ebfa4c581ec
- SHA512 186add967d0148bc6f34dc3e026e18bcaaab73b729d9f398d9e6b330e51893f610b12bd6c52e79abb4e9571b27b71663f7a9d51dad0e95de8ec9be2c9b812b4e
- SSDEEP 384:7ALiSWqC3YIDhc6MHv4BiKmtbuly4S+dZfgKOpSHuGUCXKyIw:0+3YI2NHv4BiZylt1USHLa
- TLSH T1CE825B0B5B64EC37D3D104B4192491326FBB4AFC2E19B9C7F9801D8D14BC6E8DA6A952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\usb_driver\license\WinUSB\license.rtf
- Size 148KB
- SHA256 749f67297cd87fc45d0986e3fe9ff0977a80f80d63188885816bc6f9324892c0
- MD5 0e36781bb0f25fe141f3fd13e733de6a
- SHA1 fdbd8c2ae37169d4eed84cd1adf4e4a8b666e561
- SHA512 6264de32c517be4fbb2872d18e77a0f0b078142acf344e6180b7e54399654354f82052f66a4f1d2e9f332bfdf1b1ea644599fc298a078786584d4c32d02d9be0
- SSDEEP 768:D6dYNk4ZdaL6yz3PJH7w9CHzzE54cQF2dA6Vfv1mRL9/8csWHyfnO4E3fX9PAud2:DDNGwjCNj1g/iSnliwhBDH
- TLSH T14FE3827CC585E3C5C322C38EE9ADF18EA836F10854B970F9A6EEC3B9807ED145D69406
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\usb_driver\x86\WdfCoInstaller01009.dll
- Size 1.4MB
- SHA256 7a6bf1f950684381205c717a51af2d9c81b203cb1f3db0006a4602e2df675c77
- MD5 a9970042be512c7981b36e689c5f3f9f
- SHA1 b0ba0de22ade0ee5324eaa82e179f41d2c67b63e
- SHA512 8377049f0aaef7ffcb86d40e22ce8aa16e24cad78da1fb9b24edfbc7561e3d4fd220d19414fa06964692c54e5cbc47ec87b1f3e2e63440c6986cb985a65ce27d
- SSDEEP 24576:GjG90oN2lj11mk/22yYzGrarZRm4X5Uh6rVh5LdfBwOyCSQM1fFhSWRA2+:iGtN2h1120R7m4XShYVxfBwrC21fXSz
- TLSH T1BF65234193FE0258F8F61BB0BA7CA9916A397DD25E36D48F12199C9C18B1B80DCB1773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\usb_driver\x86\winusbcoinstaller2.dll
- Size 831KB
- SHA256 ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
- MD5 8e7b9f81e8823fee2d82f7de3a44300b
- SHA1 1633b3715014c90d1c552cd757ef5de33c161dee
- SHA512 9ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9
- SSDEEP 12288:cZq3DFVAZjj5h7OqGDqY66s32+0SLqfhA50yWI7yBoM1oGloLwtxJYnPXrmQlT:cZwoP7MYG+pX501zBoC+wtxuPXrmQlT
- TLSH T1DA051211B7A48271E4E326B486BCA1B1597DB9B10B30D4EF6782A2DD0DB53C0DA7831F
- MD5 SHA1 SHA512 SSDEEP TLSH