2c6c990ee075aabb6a8560a259f6b9bcca03d108755f277b280191a58c21a585

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe
Size 2.4MB
Sample260504-krml2sez91
SHA256 2c6c990ee075aabb6a8560a259f6b9bcca03d108755f277b280191a58c21a585
MD5 25f82070c048fdf3c9d0ece505388cdd
SHA1 03941479589b93e959f7f82d7ab692895bd871db
SHA512 f0bd29c280232e9603d7ee610b91f7b1316bc291301a049ea4c62027f43c1071792f7b82de869081e71a8a0740128e2c7ed96ebc5a558355490f586d997824b2
SSDEEP 49152:Doa1taC070UARy0nO34nHURWdT5CtX6jvlND0ttxuazRKcj:Doa1taC0CUqCso6jl503xbNK
TLSH
T182B5E007F79194E5C5A90934DE204291572AF832AAF75A53398C130ECF5778ABF22F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4984	EEB5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4984	EEB5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EEB5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 4984	1324	2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\EEB5.tmp
  "C:\Users\Admin\AppData\Local\Temp\EEB5.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-05-04_25f82070c048fdf3c9d0ece505388cdd_amadey_elex_njrat_smoke-loader.exe 0C5BCA6C9A5F2B487AF570AE1CC6EEDE93F339A6E8F7A2421A4FB2808E84E14C6E4BAEFF10A5E9274A469AFB64ED60DD11EAF2A1101A973680837F02F2452562
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EEB5.tmp

Path C:\Users\Admin\AppData\Local\Temp\EEB5.tmp
Size 2.4MB
SHA256 c33a18abaf980c0f4529dbceea926d0b449e0a9315fcc31a671d2aa0d22d8a52
MD5 218250c5973b7b7c6e5a3df2c33fb66d
SHA1 7216aeb3f1892f3b84c701220dabc869a8b3d7b3
SHA512 506f4cd32cd8eb2bd199749b21754d4064864ebe783ee20bd547ef9d0a49397368eda99925ca993d49b68fe54321c4049a0d9e5ead8df081463f0dac95a5eecd
SSDEEP 49152:Doa1taC070ULzDWpF9sWZmRr00ZW5rWinQFOJT:Doa1taC0kj9s0k00olAF
TLSH
T138B5E003F79594E1C2990A75EE504251973AE832AAFB1653798C130ECF53786BF22F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download