Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
08/08/2026, 04:42
General
- Target 2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe
- Size 1.5MB
- Sample260808-fb7vtstvgw
- SHA256 f37a606e934fb5e05b312e61e0b3116c774b34b171e2cbb97656e2e2f2fe78be
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 34 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 36 IoCs
- Executes a command shell one-liner 1 TTPs 33 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE26.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE20E.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE3A4.bat6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE46F.bat8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE569.bat10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE625.bat12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE6F0.bat14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7DA.bat16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8F4.bat18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE9CE.bat20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAB9.bat22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB84.bat24⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEC7E.bat26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aED49.bat28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE62.bat30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF2D.bat32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFE9.bat34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0B4.bat36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF170.bat38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF23B.bat40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF306.bat42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"43⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5B5.bat44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"45⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFB53.bat46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"47⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBEF.bat48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFCF9.bat50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD95.bat52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE41.bat54⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AC.bat56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF39.bat58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFF4.bat60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1090.bat62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a111D.bat64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11F8.bat66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe"67⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
$$aDE26.bat
$$aE20E.bat
$$aE3A4.bat
$$aE46F.bat
$$aE569.bat
$$aE625.bat
$$aE6F0.bat
$$aE7DA.bat
$$aE8F4.bat
$$aE9CE.bat
$$aEAB9.bat
$$aEB84.bat
$$aEC7E.bat
$$aED49.bat
$$aEE62.bat
$$aEF2D.bat
$$aEFE9.bat
$$aF0B4.bat
$$aF170.bat
$$aF23B.bat
$$aF306.bat
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
2026-08-08_f15eb43f99f1896ed7495aa3561ca075_amadey_elex_smoke-loader_stop.exe.exe
Logo1_.exe
_desktop.ini
memory/428-1971-0x0000000000400000-0x0000000000445000-memory.dmp
memory/520-0-0x0000000000400000-0x0000000000445000-memory.dmp
memory/520-11-0x0000000000400000-0x0000000000445000-memory.dmp
memory/748-33-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1048-5700-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1208-175-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1340-80-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1484-125-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1516-151-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1560-105-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1776-23-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2100-41-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2516-183-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2720-5695-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2868-5690-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2872-159-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2940-141-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2984-1956-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3032-5705-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3524-191-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3700-1966-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4088-50-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4168-5006-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4488-58-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4720-117-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4976-100-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4976-8160-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4976-3544-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4976-12-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5096-66-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5280-5711-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5280-5706-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5284-167-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5300-133-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5484-1961-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5768-1976-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5772-88-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5792-1591-0x0000000000400000-0x0000000000445000-memory.dmp
memory/6040-96-0x0000000000400000-0x0000000000445000-memory.dmp