36f7fbd27fcb9246a50e987f9577a5fa1bebc872f8910703c4c805c2e6924d20

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_27c6335732dc53d21767c3c721c40bfb_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Size 37.8MB
Sample261009-xe8d7sdg42
SHA256 36f7fbd27fcb9246a50e987f9577a5fa1bebc872f8910703c4c805c2e6924d20
MD5 27c6335732dc53d21767c3c721c40bfb
SHA1 a1523bc5153fcd1e3b2d0a96b103d6b40443505a
SHA512 6e8c4767cad485b5e980b732ea787d9dcdebd62fc24e4c5178136c9288e4c36b846a4f2a29183d84307b68af2bb16dd4c01eb6b760cc30a33a8656180567fcfb
SSDEEP 786432:cHuJYYAfsBssTrAnIMnuXGbMDZDUKm7W2HxWSubnTwrIErtGk0:0ubKsvAI0MxHwWEx36nkIED0
TLSH
T190973333B82B41B5D05332358552BFB7D8E8D4A5625E7104EB524B6D3A07BA3D222F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4144	idea.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_27c6335732dc53d21767c3c721c40bfb_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idea.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4668	2026-10-08_27c6335732dc53d21767c3c721c40bfb_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
4668	2026-10-08_27c6335732dc53d21767c3c721c40bfb_amadey_elex_smoke-loader_stealc_stop_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4144	4668	2026-10-08_27c6335732dc53d21767c3c721c40bfb_amadey_elex_smoke-loader_stealc_stop_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-08_27c6335732dc53d21767c3c721c40bfb_amadey_elex_smoke-loader_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_27c6335732dc53d21767c3c721c40bfb_amadey_elex_smoke-loader_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\idea.exe
  "C:\Users\Admin\AppData\Local\Temp\idea.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

idea.EXE

Path C:\Users\Admin\AppData\Local\Temp\idea.EXE
Size 41.2MB
SHA256 beeb9e58f27066e51412b19f592ed8fc6619f03cde4d138ba293a5d36f883257
MD5 1013efa4d8812f45ea167beb2f334b55
SHA1 12654f75d40c658352d7cb21570445e8e3a2cf37
SHA512 a5390ddc96bdb12f2e0fcf1fe621caed8974c922ee8763d0b5c233a4c9eb359cd01090098c137af8fc7de68fb3949ec2bbd57c24d7015f1883da50d75ba01b0d
SSDEEP 786432:9xFO12iXpP5IPLYXWKn0JvCHp+QXEtVGhZOE3k31gmQwY:9xFrONzv0JvCHp7EtVGhZO5+mQR
TLSH
T1E1973304383CF8B5A490FEA5AAF4F7F14ABFD6047318E2289C7B5B32646459A127537C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download