a9a5e1e4383225b45de014b03cbdd810c3e71ed595b8f58a5d705a6062c56005

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_2ebb25bdce46ab4bc4e23fffef3d1d5b_amadey_elex_icedid_njrat_smoke-loader.exe
Size 3.7MB
Sample260718-e1pj4sgs9p
SHA256 a9a5e1e4383225b45de014b03cbdd810c3e71ed595b8f58a5d705a6062c56005
MD5 2ebb25bdce46ab4bc4e23fffef3d1d5b
SHA1 710edeac7cb0be2eeb1cdb6c57e355c3dfe6e4b0
SHA512 9b686ee200d5690c8e78325b6c60d9372f8d3bf14c7b7ea102b1fa613d5ab9573f8295327edff2e8ca601620a51267056e387c6fd07a140f2ff458ae59075c57
SSDEEP 98304:xmSWOiIyUppnoZM9T5e1MVLUjH5oxFbx:xXduMW1MVUjZEd
TLSH
T142060103B3558CD3D7E14A74DC50C2A25721B86D9BF35A73398813CDBC6A2D4BEA6B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3000	304D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_2ebb25bdce46ab4bc4e23fffef3d1d5b_amadey_elex_icedid_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	304D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3000	2704	2026-07-17_2ebb25bdce46ab4bc4e23fffef3d1d5b_amadey_elex_icedid_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_2ebb25bdce46ab4bc4e23fffef3d1d5b_amadey_elex_icedid_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_2ebb25bdce46ab4bc4e23fffef3d1d5b_amadey_elex_icedid_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Users\Admin\AppData\Local\Temp\304D.tmp
  "C:\Users\Admin\AppData\Local\Temp\304D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_2ebb25bdce46ab4bc4e23fffef3d1d5b_amadey_elex_icedid_njrat_smoke-loader.exe 543198F0FEF7CA4D25C26387EE87AC5731CC12FBAC8740456D6D21538CBD2056FD7D4109B8A95E73F11688C6856823C0868C280E93C3FB0273C3EF45F17A0B3F
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

304D.tmp

Path C:\Users\Admin\AppData\Local\Temp\304D.tmp
Size 3.7MB
SHA256 ec38ad5d4d39f4836d4029c6ac160ed22191a9ec544fdfa883d739a4712857c5
MD5 0aa20fee48adc395a867c0826842d90b
SHA1 0ac7a54e1abaabd66db05992542172a2fca16a6d
SHA512 84ae11f44b5b37b0315c18104eb20d91b5ab17373cbad339087638d85231836c989ec6aa7cd09a519b9649cfffd28aa79d74e27eaf78c9b7577f7c90d4fed49e
SSDEEP 98304:xmSWOiIyUHmeQPmRElA4c1+96VVLUjH5oxFbx:xX5mekmR8A4AVVUjZEd
TLSH
T1D1060103B3558CD3D3E14A74EC50C2A25721786D9FF3567379C813CEBC6A294BEA6A21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download