f987a3f24bf4aed65d198725e72d7ab9ce6805a00eeb2770ab9953412aadf330

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe
Size 2.6MB
Sample260717-xtargsbx2r
SHA256 f987a3f24bf4aed65d198725e72d7ab9ce6805a00eeb2770ab9953412aadf330
MD5 600e894a4cccffa3915631612e79fcb5
SHA1 af778f5b4509ff89be70250904ff742a9d73e5ae
SHA512 5f094df19ead01c41ae2612fc1b0645c85aeb1fb196c207528f7afb04e5676f8486dcd6536497a285df508f6e535df5af3a3b501e5759821a620364bfa812da7
SSDEEP 49152:coa1taC070UPnXJ/7WBow9ibG4GVVRf/AE0:coa1taC0FnZDkQG4eHAE
TLSH
T159D5BE13E79089D6C7D90535DE208260972AF42DABFB1672784C12CDEF53787BF21A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2404	EE4E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2404	EE4E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EE4E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2404	2440	2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\EE4E.tmp
  "C:\Users\Admin\AppData\Local\Temp\EE4E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_600e894a4cccffa3915631612e79fcb5_amadey_elex_njrat_smoke-loader.exe 78E61BD30ABFEE4281F6ED902548327B18DA78CB7F5A92483B8883A2A9F2FB476D1B75D07DAEDF07139AB45E803F11ABDA5D7F14111ACFECEC0C02D5D83D2C99
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EE4E.tmp

Path C:\Users\Admin\AppData\Local\Temp\EE4E.tmp
Size 2.6MB
SHA256 b470ac3a978c80c91dff290bab6c9bea78d40d2c51c5a3a663dcbf2b860b5bfb
MD5 c2ce59b75017f7cbfcf355c24ba68b7f
SHA1 601439647d9effdf5119729f91a8903e5c0770b9
SHA512 5aa7a89077845c88bf74c262d7d690df8671ff36987ba3bbe34c8aa77025d6347b18ae2273d81da3a8b8fb79ba1fa25ecd0e509fc8a5bd5c409a986e5cc2146c
SSDEEP 49152:coa1taC070UhkxTrlHQtZVJQ2he6L+QEe:coa1taC07kxm9he69
TLSH
T1C6D5BE13E79089E6C7D90575DE208160932AF42D9BFB5672788C12CDEE53787BF21A38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download