f23b99cfeac9db560870487e3c9691a57e3782e7b5f332c8f8ea758377b00e77

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_36891a7695bf38d139fe3d4f9f3ef9fc_amadey_elex_njrat_smoke-loader.exe
Size 2.1MB
Sample260707-e2erashx61
SHA256 f23b99cfeac9db560870487e3c9691a57e3782e7b5f332c8f8ea758377b00e77
MD5 36891a7695bf38d139fe3d4f9f3ef9fc
SHA1 a2a0e11bd83dec25a8986008e78d2316381d9d37
SHA512 22af625c798adb7bc401034af2bd5218de91548b52d80c3776d25ba495bf59921703c41c5066db50fea775b2645ce9ccb3512d955aa88c60505c1bc5654d960e
SSDEEP 49152:Roa1taC070UPEK4RvkWzoOtJluuF2GrnYkoNMXjnDdvOJFIg:Roa1taC0GK4RsatT5YLNMX7E
TLSH
T121A50205F714B0E3C6616B7068658B93A6216CBB7B019DC729C4535F0CDBAC89F63F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
784	412B.tmp

Executes dropped EXE 1 IoCs

pid	Process
784	412B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_36891a7695bf38d139fe3d4f9f3ef9fc_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	412B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 784	4480	2026-07-06_36891a7695bf38d139fe3d4f9f3ef9fc_amadey_elex_njrat_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-06_36891a7695bf38d139fe3d4f9f3ef9fc_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_36891a7695bf38d139fe3d4f9f3ef9fc_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Users\Admin\AppData\Local\Temp\412B.tmp
  "C:\Users\Admin\AppData\Local\Temp\412B.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-06_36891a7695bf38d139fe3d4f9f3ef9fc_amadey_elex_njrat_smoke-loader.exe 3AD207130872D6A639A9D3FEF6C08679BA3AB5EA8F07F192FF8968763C0435A78D90CE23EA6EFF583EA35EB0D1BDED64F3C134D0F29220AB1C83D200E15C94EB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

412B.tmp

Path C:\Users\Admin\AppData\Local\Temp\412B.tmp
Size 2.1MB
SHA256 bc7d51d505cf0622eb106ed4d1ce7a75af066ebb68e7b77ed9ed8d3f4e313cb4
MD5 34f793a90c870bf0147f675ab5053eaf
SHA1 2771856d358aab353f4cfebc60e1034144c1c5c1
SHA512 7fcc4b0617fade209b804e0b8ff29f356311c627788871d6bfe09f7407ea1ea3a7b4adb9dc42a3f24a982a0db4f4b2bffd8ba545af987698cc5ec209c0c66f88
SSDEEP 49152:Roa1taC070UhPYiFUCnBXMqaAMQptpElh1F0z+dvOJFIg:Roa1taC0rPjMK1ptwgf
TLSH
T1A8A50105B714B0F3C6615FB0A8659793A2213CBB3B419DC769C4135E4CDAAC8AF63F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download