Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
18/10/2025, 16:27
General
- Target 2025-10-18_29eef07a6347b3b0406ca3cd6f40e374_amadey_elex_smoke-loader.exe
- Size 101KB
- Sample251018-tyfazsspal
- SHA256 1ea84ed3820c5d9ba04c5500f632d8eb8cc4db2e8c360e544266fed6e1b081d5
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-10-18_29eef07a6347b3b0406ca3cd6f40e374_amadey_elex_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2025-10-18_29eef07a6347b3b0406ca3cd6f40e374_amadey_elex_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2728-0-0x0000000002850000-0x000000000288F000-memory.dmp
memory/2728-2-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-1-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-3-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-4-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-5-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-6-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-7-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-8-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-9-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-10-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-11-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-12-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-13-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-14-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-15-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-16-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-17-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-18-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-19-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-20-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-21-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-22-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-23-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-24-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-25-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-26-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-27-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-28-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-29-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-30-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-31-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-32-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-33-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-34-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-35-0x00000000029D0000-0x0000000002A16000-memory.dmp
memory/2728-36-0x00000000029D0000-0x0000000002A16000-memory.dmp