08fd998a106bcae96e304400fda92fb504585b11bb665ba278c2d43d5c66bd0d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe
Size 2.2MB
Sample260719-twprmsg12w
SHA256 08fd998a106bcae96e304400fda92fb504585b11bb665ba278c2d43d5c66bd0d
MD5 f018f88eba36952c09d7df93684c1406
SHA1 cb08fd4c41f17a73b3fdaf80fa4ab69feb1a6e74
SHA512 2ddf38b0c2410f5eb8b75402855fb5fda712680e7f9703c188074386463b049a9de0027b3db207e2c592be41c79b88f6e1d5d9619132e4cea2c1b9d4550d8730
SSDEEP 49152:Zoa1taC070UihkSQ0p0yqXupkYy36qd5Jv1m6QvOJFIRU:Zoa1taC0Ehk0TqX/56Mnvo8
TLSH
T18EB50205B704B0F3C6146BB07556DB97A62138BB7B4599C73984238F1CDBAC8AF12F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2928	F666.tmp

Executes dropped EXE 1 IoCs

pid	Process
2928	F666.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F666.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 2928	4656	2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\F666.tmp
  "C:\Users\Admin\AppData\Local\Temp\F666.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe 19E12F98207858322ECFCF85AFF2D56EDE1DBAC97235A1243E046932948980BA2207575168C33B0E4B15F9A40C5F81289E3587EE5E6029CBA6B94BB432DBF823
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F666.tmp

Path C:\Users\Admin\AppData\Local\Temp\F666.tmp
Size 2.2MB
SHA256 7e5eb7bf784da652c71f7d175f8d672f384ca950460f53f1c7e4bdd536c95b63
MD5 0883242a84eeaaf2c1dc1bce242e6132
SHA1 3120f9cb5d214e072ced972c94969e5d121e0f30
SHA512 e68f9c2d38e1dcad5201a757d78030712393178ded01ae7a472446e5d716446ed4ef0e1fe16c8622ca6b1be7b4dcc0e93a928ad34715d5208e64f0164ddac8bd
SSDEEP 49152:Zoa1taC070UOPxL/kVSwUq3E4c8Evk8QvOJFIRU:Zoa1taC0UpTkVSp4BEMa
TLSH
T125B50101B704B0F3C6116BB0754ADB97A66178BB7B0199C77984638F1DCBAC89F12F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download