a9035da07a3f1b73a4466a9312f042d8c7518a4b4f9fe85769efb6002354e621

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe
Size 3.2MB
Sample260711-pkgvfaat9k
SHA256 a9035da07a3f1b73a4466a9312f042d8c7518a4b4f9fe85769efb6002354e621
MD5 ce41a054b41a03d86f746a1e0f3326c1
SHA1 9977d53338ac33d0c02027869c7b185de76fb227
SHA512 4537ea32d13b747292729f38a01bbf8a0fec933c3bdb4c8b2d16038f72ac6dab1e55c7ecfe229631eb4ae6e294e3e51edb75836cef14aa0ec8af4ed64c37b85a
SSDEEP 98304:zmSWOiIyU4wIyQiC2Ry9nzIyVLUjH5oxFbx:zXK7RIydVUjZEd
TLSH
T199F52305775591F3D1926AF4B88283D2D5353CBABF110AC72FC8131E8C696F89E6BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1292	D49.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D49.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 1292	3860	2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Users\Admin\AppData\Local\Temp\D49.tmp
  "C:\Users\Admin\AppData\Local\Temp\D49.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe E1DDC367644643EFCD974E062A517F0490EC3B42ED3FA22E0D03AD7AEC3A8696DA28446A5118EFC993F78C4DEF1874E0E2E138E4BBB13A549DD4CDE6D7E35169
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D49.tmp

Path C:\Users\Admin\AppData\Local\Temp\D49.tmp
Size 3.2MB
SHA256 3bfa87414e2a32047ebbe61afef71f157a9f8ddc0baae1add03b1b800437675a
MD5 6ed4218159bbfe3615b14cad568d2bc4
SHA1 f8dff7932aed0ccb0b959d1f41f57544c739cb95
SHA512 00cc7945a054b1b76edd44cb4407bc6373917333318728435ae16b494ad0786908a88d329c10eba728b1a408c59809ba2ab463f9093e66d33a39b9dc1f15d06f
SSDEEP 98304:zmSWOiIyUj1jQn9LcXF5gwO5oVLUjH5oxFbx:zX92cV2T5oVUjZEd
TLSH
T117F5230A779590F2D1522EF4745247D296363C76BB114AC73EC8230E8C66BF8AF67B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download