08fd998a106bcae96e304400fda92fb504585b11bb665ba278c2d43d5c66bd0d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe
Size 2.2MB
Sample260719-twprmsg12w
SHA256 08fd998a106bcae96e304400fda92fb504585b11bb665ba278c2d43d5c66bd0d
MD5 f018f88eba36952c09d7df93684c1406
SHA1 cb08fd4c41f17a73b3fdaf80fa4ab69feb1a6e74
SHA512 2ddf38b0c2410f5eb8b75402855fb5fda712680e7f9703c188074386463b049a9de0027b3db207e2c592be41c79b88f6e1d5d9619132e4cea2c1b9d4550d8730
SSDEEP 49152:Zoa1taC070UihkSQ0p0yqXupkYy36qd5Jv1m6QvOJFIRU:Zoa1taC0Ehk0TqX/56Mnvo8
TLSH
T18EB50205B704B0F3C6146BB07556DB97A62138BB7B4599C73984238F1CDBAC8AF12F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5460	DA00.tmp

Executes dropped EXE 1 IoCs

pid	Process
5460	DA00.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DA00.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 5460	5892	2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Users\Admin\AppData\Local\Temp\DA00.tmp
  "C:\Users\Admin\AppData\Local\Temp\DA00.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_f018f88eba36952c09d7df93684c1406_amadey_elex_njrat_smoke-loader.exe 4E231679CCE5B1A78ACD5A165037F9352D36C02652FFB360617581426A32C9D0CB2DC461615D05F567416765B651051FC16A5B82200D6302D85A1F227A81E688
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DA00.tmp

Path C:\Users\Admin\AppData\Local\Temp\DA00.tmp
Size 2.2MB
SHA256 6bfe543d8c23ab3c79095f5766337bf93bd71d3742767537ea1debf2b5cfa9fa
MD5 b987df9c55559c7f8fec50ed9ffaa269
SHA1 7c7b7c2708032926ac2f77e3385c16449d6b7718
SHA512 b5e50b51ac3020b0b469329f72ae4c2a5ad521318afaeb9d24947c6c9c2b0ee452fe20de1f72f1fe212b0dac8fa0227875fc8bebca9b3d658edc365b32057585
SSDEEP 49152:Zoa1taC070Ue9ALv5+z6LkYatKdJUEO+VTqPqdy1+8QvOJFIRU:Zoa1taC0Pz5+0aAdJ/O+Pdyx
TLSH
T15CB50105B71470F3C6106BB0655AE797B22039BB7B019DC77888238E1DDBAC89F56F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download