Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 03:33
Behavioral task
behavioral1
Sample
2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe
- Size 440KB
- Sample260415-d4mn9ad15p
- SHA256 90afdf933beb06bc5a83fb1baba15f3ee7466393b5d66f420b6758f59bde131f
- MD5 157c40f3f71e3c7f630db3428e5ca83f
- SHA1 32fd0d11147f904ad74a86ce72c2b0ad2455599d
- SHA512 93f0ab5c23da58335e971090b27d66b25bf7faa8806ea706866ddd37eac60b7fd86a6a4e47e1719570842c5c3c113c6c1d74bb87beacdf1cf7a656d145209482
- SSDEEP 6144:mvrb22uGLbWhTjYVM+RwxuybHGybMb3Q/WKfCP:mDb22DShTEe+yuyzGybMFKfW
- TLSH T198A4D012B9C140F2D816303046629BB6BF7DF83113559ACF8B654D7A1F736C19B3A39A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 2124 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmp 2480 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm 544 YZH.exe 5396 YZH.exe 5572 YZH.sys - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe" 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe" 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe" YZH.exe Set value (str) \REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe" YZH.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened (read-only) \??\B: 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe -
resource yara_rule behavioral2/memory/3528-0-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/files/0x002000000002b103-9.dat upx behavioral2/memory/2480-11-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-19-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-18-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/2480-20-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/5396-44-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/5572-52-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/5396-55-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/5572-65-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/3528-88-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-89-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-92-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-96-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-100-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-104-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-108-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-112-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-116-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-120-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-124-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-128-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-132-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-136-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-140-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral2/memory/544-144-0x0000000000400000-0x000000000043F000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\YZH.sys YZH.exe File created C:\Windows\YZH.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm File opened for modification C:\Windows\YZH.exe 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm File created C:\Windows\YZH.exe YZH.exe File created C:\Windows\YZH.sys YZH.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YZH.sys - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3528 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe 3528 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 5396 YZH.exe 5396 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe 544 YZH.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 544 YZH.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3528 wrote to memory of 2124 3528 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe 80 PID 3528 wrote to memory of 2480 3528 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe 82 PID 2480 wrote to memory of 544 2480 2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm 83 PID 5396 wrote to memory of 5572 5396 YZH.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmpC:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmp2⤵
- Executes dropped EXE
PID:2124
-
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mmC:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm /zhj2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\YZH.exeC:\Windows\YZH.exe /zhj3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:544
-
-
-
C:\Windows\YZH.exeC:\Windows\YZH.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\YZH.sysC:\Windows\YZH.sys /zhj2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5572
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.mm
- Size 384KB
- SHA256 49121e227955597b180515d4f70528e1d2009c0f06a84923973b8d1ebba798b8
- MD5 4c771904573e724bcff4e52662a02fef
- SHA1 ac430465c4e28adcd9cb32d0f177ec1eb5b93934
- SHA512 cd606071b2b1b2976a72a2f56c9bf1821c829faed71fbbb4a800bfc1f524adf94493c95d27a8a9e30c848362f59d9dc62d96eb58fccc82a696d33c4594e26e88
- SSDEEP 6144:mvrb22uGLbWhTjYVM+RwxuybHGybMb3Q/Wl:mDb22DShTEe+yuyzGybMFl
- TLSH T18384E166FCC18472D91630310726DBB59F7DE83010A99BCFCB251CB65F725D29A2A38E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_157c40f3f71e3c7f630db3428e5ca83f_amadey_cobalt-strike_elex_smoke-loader_vidar.tmp
- Size 56KB
- SHA256 5113e7ae92f3a7aebc7f8e363209866d4d743b06a26c67e0886979a56fd3a10d
- MD5 a05b36f6129223951282f9df776761b1
- SHA1 ec87fa41a670cffa5d77f64366fe109278661f2c
- SHA512 38b588b28057994305a3abc37d98770ab7ff905cba6da35e91b2936b99823955fc91b90a23174d53337dd62e320b9bac066b76734bf657de9fad6d37071c70da
- SSDEEP 768:dE2lGZD4TzvPYNWw1Asvvzzv6t0+3eQKyvqjjUJu9zVB:c+I8K/XCKCGSqzV
- TLSH T11E436B066BB900DAE05B81B0C5E25A4BFE79F552235196CF0FB8C21A1F637C09F39766
- MD5 SHA1 SHA512 SSDEEP TLSH