a9035da07a3f1b73a4466a9312f042d8c7518a4b4f9fe85769efb6002354e621

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe
Size 3.2MB
Sample260711-pkgvfaat9k
SHA256 a9035da07a3f1b73a4466a9312f042d8c7518a4b4f9fe85769efb6002354e621
MD5 ce41a054b41a03d86f746a1e0f3326c1
SHA1 9977d53338ac33d0c02027869c7b185de76fb227
SHA512 4537ea32d13b747292729f38a01bbf8a0fec933c3bdb4c8b2d16038f72ac6dab1e55c7ecfe229631eb4ae6e294e3e51edb75836cef14aa0ec8af4ed64c37b85a
SSDEEP 98304:zmSWOiIyU4wIyQiC2Ry9nzIyVLUjH5oxFbx:zXK7RIydVUjZEd
TLSH
T199F52305775591F3D1926AF4B88283D2D5353CBABF110AC72FC8131E8C696F89E6BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1144	44CF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44CF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1144	2592	2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\44CF.tmp
  "C:\Users\Admin\AppData\Local\Temp\44CF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-11_ce41a054b41a03d86f746a1e0f3326c1_amadey_elex_njrat_smoke-loader.exe C6FDC4E68E445BB9603999522DC6B4AE7A7C74A575F537449F06002A7691528E90C978E93E02534BE1A7E4924F6EC4F8614FB6B9458927777C83414216C7DF1F
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\44CF.tmp
Size 3.2MB
SHA256 cfe9db3199b2ce824343677a1db5e8cf669ee3ad1d574c16f764d6f78274d6d3
MD5 582d69ff64f5af9e3fe79ed4b3d0b9ab
SHA1 74ba130536163c8957c33ebd39f1d7d895a0cdc4
SHA512 e003f8e14e3caa13c35ec25b3d2e0b8d69d62f2e5c7c2a51cdc0f58d468ef1f59513447229989cf90c9582401328f42f7e27e3bc9dce62eceb4589e1477ae561
SSDEEP 49152:zvm22OdWOXqrbIyUJV7X4+LCIblx9rnr4PLwLVT5kUvgJSgHT6ojkxFbxLWC3:zmSWOiIyU3X1JhxluIVLUjH5oxFbx
TLSH
T1CCF52309B76491F3D1622EB4B45183C696313DBABB1149D72EC4230E8C766F8AF77B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download