535e76aa68a3b50d22b1cd15093eaef790f4362e40c2663bf075d908a2729f02

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_de5dbdbb0483cfaa41e670f6f23cca53_amadey_elex_njrat_smoke-loader.exe
Size 2.5MB
Sample260705-fdgfnads4j
SHA256 535e76aa68a3b50d22b1cd15093eaef790f4362e40c2663bf075d908a2729f02
MD5 de5dbdbb0483cfaa41e670f6f23cca53
SHA1 558d05c73f567b03fb1de16ac656f0431e48b5a9
SHA512 bda3ad2e33676edcc65ccdb11626dcd9da31cbfad490d1e421fd5abae5300ef0a59c7bed317bc338a817af461b697db865c4a0e60de67fadb661cfc461b1e183
SSDEEP 49152:/oa1taC070UT/db2yQGjpmMw/wbPV4RebEeAcnlaAlpKqkPVD:/oa1taC0x1qyQGjpdfLO5eAcnvk1
TLSH
T11CC5DF03E3514CE2C7D54A34EE50C2615726B86DABF74672398C03CEEF17786BE25A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6084	7E62.tmp

Executes dropped EXE 1 IoCs

pid	Process
6084	7E62.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7E62.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_de5dbdbb0483cfaa41e670f6f23cca53_amadey_elex_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 6084	3648	2026-07-05_de5dbdbb0483cfaa41e670f6f23cca53_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-05_de5dbdbb0483cfaa41e670f6f23cca53_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_de5dbdbb0483cfaa41e670f6f23cca53_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\7E62.tmp
  "C:\Users\Admin\AppData\Local\Temp\7E62.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-05_de5dbdbb0483cfaa41e670f6f23cca53_amadey_elex_njrat_smoke-loader.exe 2A98D3F1C70393F35F58C04301305F14B50919C9C5E163C4E8892B0B6959198C941C28F1373AD432D4AFB4708DA79BBD3BFE79CB1B1B600743C8A2E4B60D4E83
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7E62.tmp

Path C:\Users\Admin\AppData\Local\Temp\7E62.tmp
Size 2.5MB
SHA256 61cabe25565dc9a41f2bf82429bcf74cdcb2606c5bbd2868bc80f90b6ba5a681
MD5 7bf45e633e83db435c9c99657f5667a9
SHA1 d7ec52d068659b2b8a10ddebe3e2e9c42381ccce
SHA512 8b5af1a5f63b82af03e6e140c55d349360572e347675450d28b906e9a736d00417e6a8aa752acb145a1fb972612f9d2e552b05cbe29d6b613815e4436f583b76
SSDEEP 49152:/oa1taC070U+DoBwwwd+ScaWyhBBFcqYb:/oa1taC0Wwwd+ScaWUxk
TLSH
T1BAC5DF07E7558CE2C7D40634ED10C2615726B86EABF74A72398C03DEEF17786BE21A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download