b6786297a058a63ff53b44f8dbc0a222a69a20e33e83c439ba384f77fc04aa2f

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_e0b3f38a97cc4b386ce5d2f161cbaad4_amadey_elex_njrat_smoke-loader.exe
Size 3.2MB
Sample260714-w35sjsdv8x
SHA256 b6786297a058a63ff53b44f8dbc0a222a69a20e33e83c439ba384f77fc04aa2f
MD5 e0b3f38a97cc4b386ce5d2f161cbaad4
SHA1 89203dd0f5d78c56b0435a839f01085ef5869d09
SHA512 d811da3a2233e921b77a485b8480fe9b9da22dd5236e8227fb43a066cae78dbfa0d2134466c073656a8631ff3c0781c94407cf3212df5bc3e8e6af769a95764b
SSDEEP 98304:zmSWOiIyU9W1gEe9GfuVEsigwVLUjH5oxFbx:zX/WQ9GfuesbwVUjZEd
TLSH
T1D9F52209375491F3E1526EB4B49283D291317D7A7B610AD72EC8130E8C766F8AF7BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3872	135F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_e0b3f38a97cc4b386ce5d2f161cbaad4_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	135F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3872	3032	2026-07-14_e0b3f38a97cc4b386ce5d2f161cbaad4_amadey_elex_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_e0b3f38a97cc4b386ce5d2f161cbaad4_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e0b3f38a97cc4b386ce5d2f161cbaad4_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Local\Temp\135F.tmp
  "C:\Users\Admin\AppData\Local\Temp\135F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-14_e0b3f38a97cc4b386ce5d2f161cbaad4_amadey_elex_njrat_smoke-loader.exe D80A89A49DA753D113991E8CB3AF54FEFB12A230C183F975C566A428738E72F8B679AE148D9E7E4AE960C9A8EF31CF9D326B2E12FDF2B5AAA22C61DABE4B0079
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

135F.tmp

Path C:\Users\Admin\AppData\Local\Temp\135F.tmp
Size 3.2MB
SHA256 f239a9e6577797f3ec86961d1362b76d9bb07d7640572186e362b8f29bba5bc6
MD5 a064f0a403fbdb8d1092061ea717698e
SHA1 4087d8a9a08ee12e60130448d89d27d4474e7222
SHA512 dc7775a5b1c887e57d8924e2da38845d5e9142f7220831f55d31318e0effddda347d51a24515ecf3882778a888a031f71d807d4b216e7372e077700277bc75d8
SSDEEP 98304:zmSWOiIyUuMIGx/5Mkp8C266eVLUjH5oxFbx:zX+QBLM6tVUjZEd
TLSH
T1D6F52305779590F3D0625EF0785183D296363DBABB111AD72EC8130D8C666F8AF7BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download