Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 21:34
General
- Target 2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe
- Size 1.6MB
- Sample260826-1e7pfsfe68
- SHA256 3781a535e5306c10b382e8c7663cd97dcb89ef4b85f76e08871a7f1747c3bcaa
Score
7/10
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 40 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 42 IoCs
- Executes a command shell one-liner 1 TTPs 39 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE31.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a110.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EA.bat6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a313.bat8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D.bat10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F2.bat12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73A.bat14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a805.bat16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E0.bat18⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DA.bat20⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB60.bat22⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"23⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B.bat24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"25⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD06.bat26⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC2.bat28⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFA.bat30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFC5.bat32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1081.bat34⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a114C.bat36⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11F8.bat38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12B3.bat40⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"41⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BDB.bat42⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C87.bat44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D33.bat46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DDF.bat48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E8A.bat50⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"51⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F27.bat52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F44.bat54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a301E.bat56⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"57⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30AB.bat58⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3157.bat60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31E4.bat62⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a328F.bat64⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"65⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35FA.bat66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36A6.bat68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3733.bat70⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"71⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37DF.bat72⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a385C.bat74⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"75⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38F8.bat76⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3994.bat78⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe"79⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
$$a1081.bat
$$a110.bat
$$a114C.bat
$$a11F8.bat
$$a12B3.bat
$$a1BDB.bat
$$a1EA.bat
$$a313.bat
$$a41D.bat
$$a5F2.bat
$$a73A.bat
$$a805.bat
$$a8E0.bat
$$a9DA.bat
$$aB60.bat
$$aC3B.bat
$$aD06.bat
$$aDC2.bat
$$aEFA.bat
$$aFC5.bat
$$aFE31.bat
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
2026-08-25_72912a54dd0fce5d53afb1fdb9f574d6_amadey_elex_smoke-loader_stop.exe.exe
Logo1_.exe
_desktop.ini
memory/240-72-0x0000000000400000-0x0000000000445000-memory.dmp
memory/832-31-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1052-0-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1052-13-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1300-1951-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1344-159-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1348-80-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1368-1966-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1388-49-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1568-23-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1704-5680-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1748-6196-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2020-5700-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2572-117-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2680-175-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2848-6181-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2916-88-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3228-1961-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3272-1956-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3924-6197-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3924-6202-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3932-6191-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4152-167-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4172-5705-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4336-207-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4372-10-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4372-109-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4372-8182-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4372-3622-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4444-58-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4596-1945-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4656-5695-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4776-133-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4864-5690-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4916-5685-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4956-1971-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5024-151-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5044-6171-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5096-108-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5224-6186-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5340-143-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5480-41-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5716-6176-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5920-125-0x0000000000400000-0x0000000000445000-memory.dmp
memory/6036-96-0x0000000000400000-0x0000000000445000-memory.dmp