35cd3b7017a4400383cb881aa2a9f426ea9575f5fd727172c0dc29f3abfcf8c2

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_dc66231fcf9b77838dc3cf4a097dd766_amadey_elex_njrat_smoke-loader.exe
Size 3.2MB
Sample260714-tpvdjsgs5q
SHA256 35cd3b7017a4400383cb881aa2a9f426ea9575f5fd727172c0dc29f3abfcf8c2
MD5 dc66231fcf9b77838dc3cf4a097dd766
SHA1 9d0bd3c6bffee507fe25cc2d1f8f09d2a3f3a2f7
SHA512 2512e07a6d23cf40cec3d1bd021401e784a2531acd30582b54c5dca396dc1e9b7368e65cef804a827cc806d688fdd8cd219c4372cd61049a44fcc18458a75e70
SSDEEP 49152:zvm22OdWOXqrbIyUJVfsgS0jzQRbQ3bZUgVZKNedUaRIwLVT5kUvgJSgHT6ojkxv:zmSWOiIyUVzQRU3OM9bDVLUjH5oxFbx
TLSH
T184F5230677A1E0F2D1616EB4789187C295313DB67B614BC72EC4130E8C76AF4AFA7B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2496	34D2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_dc66231fcf9b77838dc3cf4a097dd766_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34D2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2496	2816	2026-07-14_dc66231fcf9b77838dc3cf4a097dd766_amadey_elex_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_dc66231fcf9b77838dc3cf4a097dd766_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_dc66231fcf9b77838dc3cf4a097dd766_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\34D2.tmp
  "C:\Users\Admin\AppData\Local\Temp\34D2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_dc66231fcf9b77838dc3cf4a097dd766_amadey_elex_njrat_smoke-loader.exe F6D95CC874B061C039DCC7D7D797517C789D65E5423995EFAEDCCDEBA534AD939785835EEE518BC20DA3ADD0A22D47B100EFB70049D4E1EE75431A7739246FE7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

34D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\34D2.tmp
Size 3.2MB
SHA256 871378e988567c835395fcad39f0d8eb374190128347993fb60c50fcba739b64
MD5 89e35dcb83c4c823edbb497590d9a1a2
SHA1 4341029eef1946111145f1574e6db5185dd7def7
SHA512 d1995ab55c16d110f8b0a55dfbe76292421a5a0881a843f6ee726737813ee278c351d7a8787e61da1f0440a818e79d95fe3a6b6d93b02d9d99368bd91e200da9
SSDEEP 98304:zmSWOiIyU2rPpHRmE9x8tVLUjH5oxFbx:zXYxHoQOtVUjZEd
TLSH
T115F52306B750D1F2D1526AB4784187D296323DBABB114AC72EC8231E8C766F8EF77B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download