9b1a9b6edd10057c2c25c73a98a003d3fba18c53a41b1cb9a9869fc676085eda

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_f18a50b15b9aaa149cdef5e5e428c460_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260707-aappzaay4l
SHA256 9b1a9b6edd10057c2c25c73a98a003d3fba18c53a41b1cb9a9869fc676085eda
MD5 f18a50b15b9aaa149cdef5e5e428c460
SHA1 bee04b2aed4845a620ba45cb6644116e94b4d5cc
SHA512 875ad6561c39c5b81767c4bc14fcad7a4ac3fec61ddab23f36caf93c7e0d90748f2671a696903d4d2d66b8a5cfad3814fda90b673c458ec22a83eedecc218251
SSDEEP 24576:a2oo60HPdt+1CRiY2eOBvcj3u10ULCtiv2KnyeHIHcbwvZ8cmdsXYaodK6ea76tC:joa1taC070UCiv1nZ6cUvAaWeiEfeT
TLSH
T197B5F113F79586E5C69D49769F204282923AF8225B0B56427ACC131ECF5378B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5028	8D0.tmp

Executes dropped EXE 1 IoCs

pid	Process
5028	8D0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_f18a50b15b9aaa149cdef5e5e428c460_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8D0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6056 wrote to memory of 5028	6056	2026-07-06_f18a50b15b9aaa149cdef5e5e428c460_amadey_elex_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_f18a50b15b9aaa149cdef5e5e428c460_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_f18a50b15b9aaa149cdef5e5e428c460_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Users\Admin\AppData\Local\Temp\8D0.tmp
  "C:\Users\Admin\AppData\Local\Temp\8D0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_f18a50b15b9aaa149cdef5e5e428c460_amadey_elex_njrat_smoke-loader.exe 07232CF826577B6A7848207E126D14AB39A48EE8A8EEFE43346072C2BA0BC8B3A247AAC8344B81E0856ADA70D1890E4447991F072C53038ED4A14C79AC9FBC3F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8D0.tmp

Path C:\Users\Admin\AppData\Local\Temp\8D0.tmp
Size 2.3MB
SHA256 41e3ea20f8ccb6de332e5d856de15a1eaccac440d17791b18de7b88f08026032
MD5 c0862f5b2fd31faf6dc62129c5d0d9bd
SHA1 706dafceabf300bc425666ce2e505916fffda33a
SHA512 3957b9f5d8184e5dfeba4c8611699385d681e19a789c921ef1e94867ddc4a55b5a0994c9bc077d9275e125c7e4bb3c9955b362e12e7252c65fbca4e0720fff3b
SSDEEP 49152:joa1taC070U7BDNl0hB6RYO4mgvA7dLUwr/1Nf:joa1taC0h+aR4MhUwr/v
TLSH
T1E2B5F153F79195E5C65D0575AB608282922AF8325A0B57427ACC131ECF63BCB8F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download