c232fd41f23401ad3ef17b0622a630570de16210c908017410600a238720759d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_36eee0894d3338bd83c8baaf07a7628e_amadey_elex_njrat_smoke-loader.exe
Size 3.4MB
Sample260718-ewlyesf17k
SHA256 c232fd41f23401ad3ef17b0622a630570de16210c908017410600a238720759d
MD5 36eee0894d3338bd83c8baaf07a7628e
SHA1 146b41d2a21a8b82babee8cb029c04ee8a0124f3
SHA512 9d58c7bad7a8e1a3fc59124b2919ec8003589c1916f6cef20c73bfb3743f41e6ae9e22c4781f805f956bf2a178357887addfa824aa0fe90a88698563c9841ad5
SSDEEP 49152:Uvm22OdWOXqrbIyUJVoRcfOClLJYTn6TPWMofkv3wLVT5kUvgJSgHT6ojkxFbxL6:UmSWOiIyUlJJYuTuM1MVLUjH5oxFbxm
TLSH
T176F512027714B0F3C211ABF4685697D7A2317C6B7B51A9CB1E84234E8CDBAD89F93B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4912	4760.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_36eee0894d3338bd83c8baaf07a7628e_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4760.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4912	3564	2026-07-17_36eee0894d3338bd83c8baaf07a7628e_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_36eee0894d3338bd83c8baaf07a7628e_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_36eee0894d3338bd83c8baaf07a7628e_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\4760.tmp
  "C:\Users\Admin\AppData\Local\Temp\4760.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-17_36eee0894d3338bd83c8baaf07a7628e_amadey_elex_njrat_smoke-loader.exe 968387797B9BA1D500D62137AE8550F04202B540404DE2F9F1981D06945D9694C7CBE8EAF35E8F8B3CB39D4816E38EA1AE7D183BC60A47749A0989F97DC25C9A
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4760.tmp

Path C:\Users\Admin\AppData\Local\Temp\4760.tmp
Size 3.4MB
SHA256 a8be66e2c1a55dae92503c6a973473963897cfccaf83cf42a202417a3d44656f
MD5 1fdf22fc7373477e4afaca3956ee7131
SHA1 797f6cc705321de8007e2070f1652bc948dd7d76
SHA512 0cac2e52029e3236406724c7b79eb46f8e96f462566a010f07e71f4876118596ef21e0920399421025fad89f57f4bc5e947955ec72df6400b451ca70bf4755fd
SSDEEP 98304:UmSWOiIyUZVF7EjNvGJqL0cDTW6wdKygOoV/DoaVLUjH5oxFbxm:UX7VBEiqL0c26zyV6/DTVUjZEdm
TLSH
T183F512017714B4F3C2116BF0749697C7A2317DA77B1599C72EC4234E8CABAD8AF92B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download