2c6c990ee075aabb6a8560a259f6b9bcca03d108755f277b280191a58c21a585

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe
Size 2.4MB
Sample260504-krml2sez91
SHA256 2c6c990ee075aabb6a8560a259f6b9bcca03d108755f277b280191a58c21a585
MD5 25f82070c048fdf3c9d0ece505388cdd
SHA1 03941479589b93e959f7f82d7ab692895bd871db
SHA512 f0bd29c280232e9603d7ee610b91f7b1316bc291301a049ea4c62027f43c1071792f7b82de869081e71a8a0740128e2c7ed96ebc5a558355490f586d997824b2
SSDEEP 49152:Doa1taC070UARy0nO34nHURWdT5CtX6jvlND0ttxuazRKcj:Doa1taC0CUqCso6jl503xbNK
TLSH
T182B5E007F79194E5C5A90934DE204291572AF832AAF75A53398C130ECF5778ABF22F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5060	37E4.tmp

Executes dropped EXE 1 IoCs

pid	Process
5060	37E4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37E4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 5060	3708	2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Local\Temp\37E4.tmp
  "C:\Users\Admin\AppData\Local\Temp\37E4.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe 67F15D64DC3F90FB5BFBB3FF08F7EAAA983D1821D009A12AB0D187CED800D30537789218298CC0994B610583468BE24BD5A5CDEE9DF23428F8F25CB2746684E7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\37E4.tmp
Size 2.4MB
SHA256 8299989b6e743ab04137cea1f694b57be2e4b4801a2fbda71e9bbf897bc3aa39
MD5 0772943483999aa77f3aa349f735b775
SHA1 9cba436e1154807de117e3e707a7fbe67ae37397
SHA512 790fd0c755c5d769de52ee27e40c755a3d30a03546ec25097fc488ca6bc8a6cb0697185dbb5f289cd2857cdd28bba22f375cbf642565e51544c06e2e2dfcbfa5
SSDEEP 49152:Doa1taC070U8PXTpOkiBBMnqS+QkvsmRjJ/GhO6RL:Doa1taC0K/TpOZ+qSpBmRt/Gh
TLSH
T182B5F107F79194E5C5A90A30EE604251572AF832AAF74A53798C130ECF57786BF22F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3708-5-0x0000000002400000-0x0000000002681000-memory.dmp

Download

memory/5060-7-0x0000000002570000-0x00000000027F1000-memory.dmp