9b85f4a656f98a97207f649b64ba9778c2c8cf719cd95a96036d62a93269feb6

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 19:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_31468dd788bc5388d6ae47598303e68f_amadey_elex_njrat_smoke-loader.exe
Size 3.3MB
Sample260719-ycsfmsat4p
SHA256 9b85f4a656f98a97207f649b64ba9778c2c8cf719cd95a96036d62a93269feb6
MD5 31468dd788bc5388d6ae47598303e68f
SHA1 faa29b4cad1bf7b7d8bf264f558a7699ae607ae4
SHA512 fbe11762b3740015158944470737ae316458fb5b1589467d372c3ea24d90b9105df75fd06cf315fc364b10fd920a8046a0aad6aaa27430fce33036d48b8c1e4c
SSDEEP 98304:5mSWOiIyUkjf5Z/N3tfNvm3cY9VLUjH5oxFbxD:5XKb5hf5msY9VUjZEdD
TLSH
T1B4F5220A7759E0E3D16156B4B85183D693367CB4BF614BC33EC8230E8C726D8AEA7B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4252	2A04.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_31468dd788bc5388d6ae47598303e68f_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2A04.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4252	4772	2026-07-19_31468dd788bc5388d6ae47598303e68f_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_31468dd788bc5388d6ae47598303e68f_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_31468dd788bc5388d6ae47598303e68f_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\2A04.tmp
  "C:\Users\Admin\AppData\Local\Temp\2A04.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_31468dd788bc5388d6ae47598303e68f_amadey_elex_njrat_smoke-loader.exe FB51DE958BFB3D38EFBA2E2D9664D9C6F17AE3BDB054C22CD09852FF57F139C8336A8D5F7D4BE7FEE571BA93F116BE2E8580B7245DBCD9F9242EE4E39618DFE0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2A04.tmp

Path C:\Users\Admin\AppData\Local\Temp\2A04.tmp
Size 3.3MB
SHA256 5cfdead9b971f4c097168a7ffe7b546acac485ff66d2af126e555d5c82e9cad5
MD5 8db3f820b05e1110de98e4574e5e2158
SHA1 d4deb7c996533b09a64536ab645a677f9b3cb3b5
SHA512 b4f3139bbde5eeed6e217cb6c2ee1580ec3f1aedfa941f4e0a558849a7aa3c53eb5764c7f06b8577357de59759a2d7bb3e12f6216343a9ffd241128c2f278303
SSDEEP 98304:5mSWOiIyUlQ0HEGF8uZWKnWNlXjK6wVLUjH5oxFbxD:5XDQ0t8AngKVUjZEdD
TLSH
T1F3F5120B7769E0E3C11156B8788187D5A7327CB4AF514BC33EC4231E8C676E8AEA7B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download