Overview

overview

6

Static

static

3

2026-11-01...ee.exe

windows10-2004-x64

6

2026-11-01...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    134s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 10:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_b9886a0f908ff23d2843da92cf5ab7a4_elex_smoke-loader_stealc_stop_tofsee.exe
  • Size 805KB
  • Sample261102-mmkyrsgz21
  • SHA256 76abc8560849f79127b13c7cc801b0ce5d53ea982a535ae8b3147060067fb3d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 42 IoCs
  • Drops file in Windows directory 64 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_b9886a0f908ff23d2843da92cf5ab7a4_elex_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_b9886a0f908ff23d2843da92cf5ab7a4_elex_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4908
  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_b9886a0f908ff23d2843da92cf5ab7a4_elex_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-11-01_b9886a0f908ff23d2843da92cf5ab7a4_elex_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1836
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3548

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          WCChromeNativeMessagingHostAdobe.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHostAdobe.exe
          • Size 840KB
          • SHA256 96f9f80ad78c07a19b6d12c1d6bb56a0892aa3127262febcc4763deaa3ccc919
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LibraryInternet.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LibraryInternet.exe
          • Size 808KB
          • SHA256 4ce036579000d35e9506c513b0b1882f0c0e33d1713db2238b8be7e9636be464
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ReaderUtilities.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ReaderUtilities.exe
          • Size 808KB
          • SHA256 681b3f95b0e3b21b410621b5e011ecc0ab5b19883f9a908dcaf214da402f8ad2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qrcodepmpdatamatrixpmp.exe
          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\qrcodepmpdatamatrixpmp.exe
          • Size 806KB
          • SHA256 8439aa063ffff8bb2e5dae38992e5cf4084f46003315be05f5d89f9f52937b1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OperatingWindows.exe
          • Path C:\Program Files (x86)\Common Files\System\ja-JP\OperatingWindows.exe
          • Size 806KB
          • SHA256 1c7226bae351e6ed91e799f1342400bc9c0dd24ec8f2deaa540e972f7bf0879a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SystemMicrosoft.exe
          • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\SystemMicrosoft.exe
          • Size 885KB
          • SHA256 888fe4fce532fef8e495768ef1c5f137fca9095e1cf18d886610846dd4713188
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          aspnetstateFramework.exe
          • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnetstateFramework.exe
          • Size 850KB
          • SHA256 7c919a9106ff6a9b5bbc239f87a67f90a7916301e5b4e24cbb800e1e570a851d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download