0ab06d9511979d9fb7b6ca8f0d40846445b8be8b01172c5ef6dca4734e60f6b6

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 01:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_b04325bb350966d1f30d13eb50e7677f_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260707-bycwract9k
SHA256 0ab06d9511979d9fb7b6ca8f0d40846445b8be8b01172c5ef6dca4734e60f6b6
MD5 b04325bb350966d1f30d13eb50e7677f
SHA1 3d92472b8d88fa668602fcf65fd34174a98b60e3
SHA512 1635d98bb1d404d3fba6de5f66ee22317792b1d66e4ae335b25d76922428d9f0ecf60a86713952b9508d5c48d5281046b82b245a42325eee3d8304dbdbd6af53
SSDEEP 24576:42oo60HPdt+1CRiY2eOBvcj3u10UJPkXmqvyBfYj6bIfe7kvHrkh5jfE03Xz2Q+W:doa1taC070Uluigj6b/7kvHYhC03DL
TLSH
T16FB5EF03E2519CE2C3D80271EE50C261572AB46DABF70672798C13DDFF527867F26A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3172	11F8.tmp

Executes dropped EXE 1 IoCs

pid	Process
3172	11F8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_b04325bb350966d1f30d13eb50e7677f_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11F8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 3172	5764	2026-07-06_b04325bb350966d1f30d13eb50e7677f_amadey_elex_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_b04325bb350966d1f30d13eb50e7677f_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_b04325bb350966d1f30d13eb50e7677f_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5764
- C:\Users\Admin\AppData\Local\Temp\11F8.tmp
  "C:\Users\Admin\AppData\Local\Temp\11F8.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_b04325bb350966d1f30d13eb50e7677f_amadey_elex_njrat_smoke-loader.exe 07A2770C1C70F189945530E3DABD63AAB44DF8D6FB55402B40F2D0D35D2E5350383097D144FAF805C10F06D52B1C73E1B7A79F15F64E2EE0D075DE5EBBD8D3F1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11F8.tmp

Path C:\Users\Admin\AppData\Local\Temp\11F8.tmp
Size 2.3MB
SHA256 867e5cde1982522b9d1f3027ac2f1c84e44daa8450984a4f08f72bb37f483ad3
MD5 289ecbb6ccaa06f341fef9c6d0fff1f4
SHA1 1d5187a5b3820bf71e855261990d996334ca930b
SHA512 add351cba9cb9a42dc615aa8451527a29dd841225487b3e799aad55d6b55fe1253fca13e05d4efab1d10369321f0261bed37b88a295768abb192de3d85e20764
SSDEEP 49152:doa1taC070UOyfYazmzeouWqeltjDAqSZkEHjZx:doa1taC0Uy3zboiefMT1
TLSH
T1A2B5EF03E3518CE2C3D80574EE50C2A15726B86D9BF706B2798C03DDFF567867E26A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download