507dbabf765b1927db820408c5d5121d03337f0c081b0589d445dcdc17e53bab

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_81148e91f04f584536547f7c89d52af5_amadey_elex_njrat_smoke-loader.exe
Size 2.5MB
Sample260603-2prawse191
SHA256 507dbabf765b1927db820408c5d5121d03337f0c081b0589d445dcdc17e53bab
MD5 81148e91f04f584536547f7c89d52af5
SHA1 be8bb64d1ace8c79d3f9d98f494ed3005238a1ba
SHA512 7e912baca33d61514d5f3ff3c391701d9cf767d9d455e30b01b30fcd248c2cff14c13f08ee66a1a8295b289cf1c74a456a74feb60050569b5e4ceaad8422e07b
SSDEEP 24576:x2oo60HPdt+1CRiY2eOBvcj3u10U+a/otO29ZOqzsBQrz4hVPmkXhbo4dCRPkHSS:coa1taC070UH7Jhs8hVjXhb9okHiAB
TLSH
T1B4C5EF53E7818AE8D65D05366F208251962EF921AB0F5752798C131ECF9378B8F62F3C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1616	2863.tmp

Executes dropped EXE 1 IoCs

pid	Process
1616	2863.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_81148e91f04f584536547f7c89d52af5_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2863.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1616	2596	2026-06-03_81148e91f04f584536547f7c89d52af5_amadey_elex_njrat_smoke-loader.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-03_81148e91f04f584536547f7c89d52af5_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_81148e91f04f584536547f7c89d52af5_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\2863.tmp
  "C:\Users\Admin\AppData\Local\Temp\2863.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-06-03_81148e91f04f584536547f7c89d52af5_amadey_elex_njrat_smoke-loader.exe EDC19070DC95A69FE5D7EBCAB4DFB4AB54E8EE95AEAEE831C9A8F8CE58BA05F619CA82F3A1024CDA9515964083B75F6752D9C0B6BE4A1AF63472E3E634D01168
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2863.tmp

Path C:\Users\Admin\AppData\Local\Temp\2863.tmp
Size 2.5MB
SHA256 f06719243859eac94b7ac7d662f4ad035dd1f4d695a45aefe676d4348f9d990d
MD5 f4708b05e4c24c9ddb8bc42eab86c302
SHA1 1c7627b30ec70323d0fd2c1eaeb9f4770b53faf8
SHA512 b9814c9bc00a01b4ee31cc96f7545d58fa2c57013d8d80a5e6db51876c7b85ba97e7c9e21b0ad5d424e287a585180c80bd344f5c0f979317d4c155fc2ac50e01
SSDEEP 49152:coa1taC070UHgkuuU8Jrkr/hDj7Op3Kq6J/:coa1taC06kud8Fkr/lj7Yaq6
TLSH
T16BC5EF63E7928AE8D64D05766F208241962EF521AB0F5742798C130DCF9378B8F66F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download