Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 15:52
General
- Target 2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe
- Size 1.7MB
- Sample261002-tbfy1ade53
- SHA256 d74113bd51a77b238acb4d129147217b9adca8d303314901b1f1f9e6d6977a01
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 43 IoCs
- Enumerates connected drives 3 TTPs 43 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 47 IoCs
- Executes a command shell one-liner 1 TTPs 41 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a380E.bat2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C05.bat4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D6D.bat6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F03.bat8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"9⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a405B.bat10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"11⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4220.bat12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"13⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4387.bat14⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"15⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45C9.bat16⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"17⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4869.bat18⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"19⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4992.bat20⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"21⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B57.bat22⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C9F.bat24⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"25⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D8A.bat26⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"27⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F3F.bat28⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"29⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50A7.bat30⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"31⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51DF.bat32⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"33⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5318.bat34⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"35⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5450.bat36⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"37⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5579.bat38⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"39⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56C1.bat40⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57CB.bat42⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58D4.bat44⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"45⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59DE.bat46⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"47⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65A6.bat48⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"49⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66AF.bat50⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"51⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a678A.bat52⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"53⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68A3.bat54⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"55⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7015.bat56⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"57⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76CC.bat58⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"59⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7814.bat60⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"61⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a796C.bat62⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"63⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A56.bat64⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"65⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B60.bat66⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"67⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2B.bat68⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"69⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D16.bat70⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"71⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DD1.bat72⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"73⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EAC.bat74⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"75⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F77.bat76⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"77⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8061.bat78⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"79⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a813C.bat80⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"81⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8236.bat82⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe"83⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe20⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"21⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"22⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 9603⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5784 -ip 57841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
$$a380E.bat
$$a3C05.bat
$$a3D6D.bat
$$a3F03.bat
$$a405B.bat
$$a4220.bat
$$a4387.bat
$$a45C9.bat
$$a4869.bat
$$a4992.bat
$$a4B57.bat
$$a4C9F.bat
$$a4D8A.bat
$$a4F3F.bat
$$a50A7.bat
$$a51DF.bat
$$a5318.bat
$$a5450.bat
$$a5579.bat
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
2026-10-01_42d51d8736b3de3eb039a1603e450d0a_amadey_elex_smoke-loader_stop.exe.exe
Dll.dll
Logo1_.exe
_desktop.ini
memory/1008-54-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1048-1997-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1056-67-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1068-4006-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1292-1991-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1636-33-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1660-4000-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1704-122-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1836-3994-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2064-140-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2280-2009-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2368-131-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2472-24-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2492-13-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2492-0-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2844-152-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2848-163-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2860-4024-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2904-4018-0x0000000000400000-0x0000000000445000-memory.dmp
memory/2928-203-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3468-194-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3504-44-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3532-213-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3624-172-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3664-3988-0x0000000000400000-0x0000000000445000-memory.dmp
memory/3928-110-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4128-225-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4156-3976-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4200-76-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4360-2003-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4504-95-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4520-4030-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4580-3982-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4768-4043-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4768-4038-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4864-3169-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4864-4045-0x0000000000400000-0x0000000000445000-memory.dmp
memory/4864-208-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5044-3970-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5260-4012-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5316-185-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5480-3964-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5780-85-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5784-11-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5784-90-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5800-231-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5884-219-0x0000000000400000-0x0000000000445000-memory.dmp
memory/5888-4036-0x0000000000400000-0x0000000000445000-memory.dmp