f987a3f24bf4aed65d198725e72d7ab9ce6805a00eeb2770ab9953412aadf330

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe
Size 2.6MB
Sample260717-xtargsbx2r
SHA256 f987a3f24bf4aed65d198725e72d7ab9ce6805a00eeb2770ab9953412aadf330
MD5 600e894a4cccffa3915631612e79fcb5
SHA1 af778f5b4509ff89be70250904ff742a9d73e5ae
SHA512 5f094df19ead01c41ae2612fc1b0645c85aeb1fb196c207528f7afb04e5676f8486dcd6536497a285df508f6e535df5af3a3b501e5759821a620364bfa812da7
SSDEEP 49152:coa1taC070UPnXJ/7WBow9ibG4GVVRf/AE0:coa1taC0FnZDkQG4eHAE
TLSH
T159D5BE13E79089D6C7D90535DE208260972AF42DABFB1672784C12CDEF53787BF21A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2036	435D.tmp

Executes dropped EXE 1 IoCs

pid	Process
2036	435D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	435D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2036	2528	2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\435D.tmp
  "C:\Users\Admin\AppData\Local\Temp\435D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe 2288EE70F5D2934BF2D7F5C43E4782ADC17785469B6264262279AFF7974C558B0517A438D5298217A57E443AE9B057F3D9B06D194F539107CF98C24064FBD37F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

435D.tmp

Path C:\Users\Admin\AppData\Local\Temp\435D.tmp
Size 2.6MB
SHA256 8545ae7848b7c8e90d56861da89de5a0e486d8e8d8f7b408903d86437e643aa6
MD5 e21e7b3c639d05c6c074b9201e9c438f
SHA1 a9e72d2c7cd74885487f5c7c1e82fd917d0aa796
SHA512 190f8c18f9044d990f81159d54e855159f835734eec280ade23f9d610cef74a1dcb6e4439861ee12d6279ab709416d462401c37541aec1280087a16bc4393847
SSDEEP 49152:coa1taC070UyHqpuwmdXU8EujrzPQY1NCEsk3awOmbbHdboGY:coa1taC0kHqQBU8zMFEsqaRM9b
TLSH
T156D5BE13E75189E6C7D80535EE108260932AF42D9BFB5672788C12CDEF43787BF61A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download