8960cca3f6f8f3136791d4687df515e8dedb1594035b181dfdaf2495653e4ad7

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 21:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_9c92e230d7b8defadfe5179bc8cd38db_amadey_elex_njrat_smoke-loader.exe
Size 2.4MB
Sample260709-z5b5sshx9r
SHA256 8960cca3f6f8f3136791d4687df515e8dedb1594035b181dfdaf2495653e4ad7
MD5 9c92e230d7b8defadfe5179bc8cd38db
SHA1 9200f45a8970bbbc5e2be26a16aa1d5be3d7ca42
SHA512 47c89ee17252c79457408bb0ea685b72a6ce3a7cd4f522eb3162df27e529447d544b70a6023e6f5d1bb806a8e23a5ba7018283bd0979b09079fc6a0840b9b063
SSDEEP 49152:Doa1taC070U7pKA9KoxEbB89r0yjO8+9VSU4:Doa1taC0FpKAkoxEh629VS
TLSH
T1E9B5F053F79186E8D69D05726F604281A22AF5216A0F5752798C130ECF63BCB8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
548	423F.tmp

Executes dropped EXE 1 IoCs

pid	Process
548	423F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_9c92e230d7b8defadfe5179bc8cd38db_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	423F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 548	4156	2026-07-09_9c92e230d7b8defadfe5179bc8cd38db_amadey_elex_njrat_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-09_9c92e230d7b8defadfe5179bc8cd38db_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_9c92e230d7b8defadfe5179bc8cd38db_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\423F.tmp
  "C:\Users\Admin\AppData\Local\Temp\423F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-09_9c92e230d7b8defadfe5179bc8cd38db_amadey_elex_njrat_smoke-loader.exe 4256DD4C80FD2C652D268F87AADF5596B00AF27E2506FCC438FEA4D613906BA1AE2AF966CF81CAF4590564989E30CD16C7E0845CB95815763BAB65F3376AE9CE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

423F.tmp

Path C:\Users\Admin\AppData\Local\Temp\423F.tmp
Size 2.4MB
SHA256 5fea49b77ab51b91503ee7fb4418ed483a6e344a6d371fd74b22620a5b340ff3
MD5 43f59f4468227f748a36172c5d7b8186
SHA1 14635c68b44af1dfd54e3c21eb120ae19a5e0804
SHA512 11b9b9f7f5b3b9749cf00ada6d3b8b0d753ab313273734fb2092d0de4aaa7f5a05c21e7cdaea800207488ed1a05cfe3dec424d4c49c3c5ce092dd6dc224a9abb
SSDEEP 24576:62oo60HPdt+1CRiY2eOBvcj3u10UO8q2bSOkJEGCpYFOuz/TlyzFQ1O+yvqo1Stq:Doa1taC070U5phRA/hyhQ12n0EMM0IE
TLSH
T1A5B5E053E78186E9D29D0532AB508281962EF531AA0F5752798C131ECF53BCB8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download