122d579890980faaefe848b1c382b3c4a688727191e27c7e8b3c00dcce10ce76

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_d128c3fa5c6096866f3f895a896f62f7_amadey_elex_icedid_njrat_smoke-loader.exe
Size 3.7MB
Sample260718-cedvdagt5v
SHA256 122d579890980faaefe848b1c382b3c4a688727191e27c7e8b3c00dcce10ce76
MD5 d128c3fa5c6096866f3f895a896f62f7
SHA1 49f3b6b1c6428d757910d9a211669ffea5747868
SHA512 d6119e07450ed3f5a27dd0951bd400ee1a3a2a09623f1a1c182f52408fb273a3412434587cf68e67c2477317b7d44e1fbec0b3e71aac9e42f584c8400f048adc
SSDEEP 98304:xmSWOiIyUc5Z8ywgJwTXrD/MZZVLUjH5oxFbx:xXywgJwTXHSVUjZEd
TLSH
T12A060107B3558CD3C3E14A74EC51C2A25721B86D9BF3567339C813CDBC6A294BEA6B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2076	6150.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_d128c3fa5c6096866f3f895a896f62f7_amadey_elex_icedid_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6150.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2076	2728	2026-07-17_d128c3fa5c6096866f3f895a896f62f7_amadey_elex_icedid_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_d128c3fa5c6096866f3f895a896f62f7_amadey_elex_icedid_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_d128c3fa5c6096866f3f895a896f62f7_amadey_elex_icedid_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\6150.tmp
  "C:\Users\Admin\AppData\Local\Temp\6150.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_d128c3fa5c6096866f3f895a896f62f7_amadey_elex_icedid_njrat_smoke-loader.exe DA831CADA9D075496F516DDAA88AE3B4069B5079B03F209984362D01DFC12BF345C6A788FF83D51FAB391CDA193E0B020398B397AB8D54B2F44A680B06760388
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6150.tmp

Path C:\Users\Admin\AppData\Local\Temp\6150.tmp
Size 3.7MB
SHA256 d4939cf1b19e8b4bb6b6c9b31b30d165dea394c6f46c6b4d57803f68537a18be
MD5 fb3fd1956ce864c2025e1067a82ff7bc
SHA1 f293b28d291d86a2873dcfacd1c0a9d0befdcb15
SHA512 96a3edc8309b8f06b058fe1810b400981f3e173745f21d25d322298e548579ac358c84b4ff3a673c24a5343ffd38c81877a10ef06f54e4b58f05fcd20ab7ffc7
SSDEEP 98304:xmSWOiIyU7vdp0gDwMvF4TVLUjH5oxFbx:xXFd9DjF6VUjZEd
TLSH
T1EF060103B7558CD3D3E14A74DC50C2A25722B86D9BF35673398813CDBC6A2D4BEA6B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download