c429926f64817c82e07145d7b7740a95a39114d239ad3b20414a1543fefd398c

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_feadc95ddc258f208d3e93aeab4c48d4_amadey_elex_njrat_smoke-loader.exe
Size 2.1MB
Sample260717-ts5npaa13s
SHA256 c429926f64817c82e07145d7b7740a95a39114d239ad3b20414a1543fefd398c
MD5 feadc95ddc258f208d3e93aeab4c48d4
SHA1 18a148c350a027fb2f3589d6c69bfcdef42eab8d
SHA512 4fd6041da78e033af19f29f250455abbc1df7e1507d31b9d2715487420cc5be8ec522e99cde26cbfb68c5efeb3145a0485d2622568416c160e723c355ff9df35
SSDEEP 49152:2oa1taC070UqlufWA16lVJ2hK9NEaEMEn:2oa1taC0yuPKJ2hKDJgn
TLSH
T1D7A512157769E0F3C5614B70A86086E2E6367CB1BF415AC33EC8531E5C62BC89F67B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4972	54FC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4972	54FC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54FC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_feadc95ddc258f208d3e93aeab4c48d4_amadey_elex_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4972	4668	2026-07-17_feadc95ddc258f208d3e93aeab4c48d4_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_feadc95ddc258f208d3e93aeab4c48d4_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_feadc95ddc258f208d3e93aeab4c48d4_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Users\Admin\AppData\Local\Temp\54FC.tmp
  "C:\Users\Admin\AppData\Local\Temp\54FC.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_feadc95ddc258f208d3e93aeab4c48d4_amadey_elex_njrat_smoke-loader.exe 60901F426D37CCCD4127B58B9D194884250CB428E3EC3900F888528ADC47DE10F30F3FC62629073A1B6512835B46216C8E693FBAE86196C0FC74B4940C935EB8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

54FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\54FC.tmp
Size 2.1MB
SHA256 c9dd85bf4208f0c5043d706d4460eab73b38c866cfc2c2bccd6c4f3f1344d867
MD5 21d35dbb0a9621ea960717886d55818d
SHA1 f54d36e8edd38f782cce00de36e5b37183047261
SHA512 9765847ad22b636e0b02ef4e025ec38de10a625f69c83f79d66ac5f1030e0eff03c7bb8caec60769122d754c4dbe07e31586e74484a3229c255788faee30a6c4
SSDEEP 49152:2oa1taC070UaurlgWU0yqOWq7/Ohbeuel1n:2oa1taC0curmWURqOVkbeB
TLSH
T1ABA5121A7758A0F3C5214A70B851C6D296377CB1AF505EC33EC8635E4C67BC89EA7B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download