90afdf933beb06bc5a83fb1baba15f3ee7466393b5d66f420b6758f59bde131f

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
Size 440KB
Sample260415-d4mn9ad15p
SHA256 90afdf933beb06bc5a83fb1baba15f3ee7466393b5d66f420b6758f59bde131f
MD5 157c40f3f71e3c7f630db3428e5ca83f
SHA1 32fd0d11147f904ad74a86ce72c2b0ad2455599d
SHA512 93f0ab5c23da58335e971090b27d66b25bf7faa8806ea706866ddd37eac60b7fd86a6a4e47e1719570842c5c3c113c6c1d74bb87beacdf1cf7a656d145209482
SSDEEP 6144:mvrb22uGLbWhTjYVM+RwxuybHGybMb3Q/WKfCP:mDb22DShTEe+yuyzGybMFKfW
TLSH
T198A4D012B9C140F2D816303046629BB6BF7DF83113559ACF8B654D7A1F736C19B3A39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
4776	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmp
2500	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm
1840	YZH.exe
2496	YZH.exe
4620	YZH.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened (read-only)	\??\B:	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/724-0-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/files/0x000a0000000242ca-9.dat	upx
behavioral1/memory/2500-11-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-18-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2500-21-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-15-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2496-39-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/4620-46-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/4620-50-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/2496-48-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/724-86-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-87-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-88-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-90-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-92-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-94-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-96-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-98-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-100-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-102-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-104-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-106-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-108-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-110-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-112-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-114-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral1/memory/1840-116-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\YZH.exe	YZH.exe
File created	C:\Windows\YZH.sys	YZH.exe
File opened for modification	C:\Windows\YZH.sys	YZH.exe
File created	C:\Windows\YZH.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm
File opened for modification	C:\Windows\YZH.exe	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.sys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
724	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
724	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
2496	YZH.exe
2496	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe
1840	YZH.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1840	YZH.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 4776	724	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe	85
PID 724 wrote to memory of 2500	724	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe	87
PID 2500 wrote to memory of 1840	2500	2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm	88
PID 2496 wrote to memory of 4620	2496	YZH.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmp
  C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmp
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm
  C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm /zhj
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\YZH.exe
    C:\Windows\YZH.exe /zhj
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1840

C:\Windows\YZH.exe
C:\Windows\YZH.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\YZH.sys
  C:\Windows\YZH.sys /zhj
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm
Size 384KB
SHA256 49121e227955597b180515d4f70528e1d2009c0f06a84923973b8d1ebba798b8
MD5 4c771904573e724bcff4e52662a02fef
SHA1 ac430465c4e28adcd9cb32d0f177ec1eb5b93934
SHA512 cd606071b2b1b2976a72a2f56c9bf1821c829faed71fbbb4a800bfc1f524adf94493c95d27a8a9e30c848362f59d9dc62d96eb58fccc82a696d33c4594e26e88
SSDEEP 6144:mvrb22uGLbWhTjYVM+RwxuybHGybMb3Q/Wl:mDb22DShTEe+yuyzGybMFl
TLSH
T18384E166FCC18472D91630310726DBB59F7DE83010A99BCFCB251CB65F725D29A2A38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmp
Size 56KB
SHA256 5113e7ae92f3a7aebc7f8e363209866d4d743b06a26c67e0886979a56fd3a10d
MD5 a05b36f6129223951282f9df776761b1
SHA1 ec87fa41a670cffa5d77f64366fe109278661f2c
SHA512 38b588b28057994305a3abc37d98770ab7ff905cba6da35e91b2936b99823955fc91b90a23174d53337dd62e320b9bac066b76734bf657de9fad6d37071c70da
SSDEEP 768:dE2lGZD4TzvPYNWw1Asvvzzv6t0+3eQKyvqjjUJu9zVB:c+I8K/XCKCGSqzV
TLSH
T11E436B066BB900DAE05B81B0C5E25A4BFE79F552235196CF0FB8C21A1F637C09F39766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/724-86-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/724-1-0x000000000043E000-0x000000000043F000-memory.dmp

Download

memory/724-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-100-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-106-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-116-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-15-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-114-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-112-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-110-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-108-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-18-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-87-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-88-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-90-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-92-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-94-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-96-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-98-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-104-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/1840-102-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2496-48-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2496-39-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2500-11-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2500-21-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4620-50-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4620-46-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4776-19-0x00007FF7E58F0000-0x00007FF7E5901000-memory.dmp

Download