4d67082abe6e2985ec73c13a0330f1aac57f2e1fa5a668242104987b1e4ba1f6

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_1832eca3e5f168f4061f7cf61d73935b_amadey_elex_njrat_smoke-loader.exe
Size 3.3MB
Sample260503-vcwarady6w
SHA256 4d67082abe6e2985ec73c13a0330f1aac57f2e1fa5a668242104987b1e4ba1f6
MD5 1832eca3e5f168f4061f7cf61d73935b
SHA1 23eca913434da6731e1e366a8d1502c0ec9fa407
SHA512 2a813644b85bdfdf1aa0d0b483568e71f6976504b1ef679f93e855162d81db0a469f84b67d1fe7461f13ed76088c84669b71f9358be2600376d88e84ad0de407
SSDEEP 49152:kvm22OdWOXqrbIyUJVFA3VYA4oCo4IEjtS9wLVT5kUvgJSgHT6ojkxFbxLWC3Xqz:kmSWOiIyUnAnASeVLUjH5oxFbxQ
TLSH
T126F512057754B0F3C2216AB4789687D792317C7B7B1199C72DC4234E8CAB6D8AF27B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4172	6387.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_1832eca3e5f168f4061f7cf61d73935b_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6387.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 4172	3652	2026-05-03_1832eca3e5f168f4061f7cf61d73935b_amadey_elex_njrat_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-03_1832eca3e5f168f4061f7cf61d73935b_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_1832eca3e5f168f4061f7cf61d73935b_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Users\Admin\AppData\Local\Temp\6387.tmp
  "C:\Users\Admin\AppData\Local\Temp\6387.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-03_1832eca3e5f168f4061f7cf61d73935b_amadey_elex_njrat_smoke-loader.exe 6145D3B4951CA64EA5D01FB9D8C97FA4750A04B15FF8680DD2FF487843B4F9D209F1E1D75CEE9A0DB36568B42C6D5C1BF102D08BA58A355F730CBFF14807D94C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6387.tmp

Path C:\Users\Admin\AppData\Local\Temp\6387.tmp
Size 3.3MB
SHA256 2b26f1f98f94f88140b8857688bd12fe1a0835de887457f15518a92fdda3f495
MD5 e00986398c627b88cb3afa54874f887a
SHA1 635cfdae4612b2d0daed1b4a0cec6198acf7134a
SHA512 14fafbe557e63dc35f7196c8944b3a357ec293ac9ca9b2df88a20851c5542b88bcc15f6bb3cddb705865975dbc8b03322656c5da7d9ba1edc5243f1a8bb07cf7
SSDEEP 98304:kmSWOiIyUDr8190zCl8Kd5aVLUjH5oxFbxQ:kXd0uz/mwVUjZEdQ
TLSH
T133F512057B18B0E3C2116AB4684597D793317CBB7F5099C72EC8234E8CAB6D8AF67B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3652-4-0x00000000008C0000-0x000000000093B000-memory.dmp

Download

memory/4172-7-0x0000000000CF0000-0x0000000000D6B000-memory.dmp