9eca699407ff3d4f862fb2c0c66b41540bbf67dcc279cec8310a99d2be644257

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_72bd6cef7012e40b1aeb323a086dbf65_amadey_elex_njrat_smoke-loader.exe
Size 2.4MB
Sample260715-feaphaby8k
SHA256 9eca699407ff3d4f862fb2c0c66b41540bbf67dcc279cec8310a99d2be644257
MD5 72bd6cef7012e40b1aeb323a086dbf65
SHA1 3a595e75dfd51195e4833654571fdee7c8c865da
SHA512 489a7f2800d3630467e98b83c5bc409a66390de4e7932cd568a94446928e3aa81daf8f658c34f51f0291303a122668e0abe074f36aaa8c00ee7eb0ada76125dc
SSDEEP 49152:Doa1taC070UPGGD0NKldnTpkBD8HaDSQCd:Doa1taC0UCXtTpSckC
TLSH
T1E4B5F013F79186E4D25D0576AF604280A62AF5216B0F57527A8C131ECF93BCB8F62E3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2844	13AD.tmp

Executes dropped EXE 1 IoCs

pid	Process
2844	13AD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_72bd6cef7012e40b1aeb323a086dbf65_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13AD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5484 wrote to memory of 2844	5484	2026-07-15_72bd6cef7012e40b1aeb323a086dbf65_amadey_elex_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_72bd6cef7012e40b1aeb323a086dbf65_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_72bd6cef7012e40b1aeb323a086dbf65_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5484
- C:\Users\Admin\AppData\Local\Temp\13AD.tmp
  "C:\Users\Admin\AppData\Local\Temp\13AD.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_72bd6cef7012e40b1aeb323a086dbf65_amadey_elex_njrat_smoke-loader.exe 4B02EBEBBEE4E27145A4FF58B4B763E2BD5C9B864574856AD2BCE29F7F3FB6E3D7BEAC79A899870CD648C84F9059425D5572FD8DDDF38CCE46C585E4790917BC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13AD.tmp

Path C:\Users\Admin\AppData\Local\Temp\13AD.tmp
Size 2.4MB
SHA256 8f724822ab22141009fd93492f99e2d2242facd82aefcfb06c8237003e0e5ad1
MD5 0a7af2342cfed4ea0cba9e394c3b0023
SHA1 d1c1bdf5d08133cfdb4fdb85d430ffd25c43d954
SHA512 5b5b3efd71f53e35b5d4d4cd548e0e9d97fe1ce63d0cae5241f5627d4a6a8e2f29030b85b30724693dce3e2035de6e3569b2ccf2cb0f58101b3a684a891fc831
SSDEEP 49152:Doa1taC070UvWQ5lGv8iCOIkg/7drM8EvD0J:Doa1taC0NWQKvXCO8wvD
TLSH
T165B5E053F7918AE9C29D0532AF104281962EF521AA0F57527A9C131ECF5378B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download