668eb287447ba0c6b2a9d260ffe2affc77e34c368c51e47a60a14019c41ca171

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_91f8e3ca553837b80268559959ebc50d_amadey_elex_njrat_smoke-loader.exe
Size 3.5MB
Sample260720-bb8d5sax9k
SHA256 668eb287447ba0c6b2a9d260ffe2affc77e34c368c51e47a60a14019c41ca171
MD5 91f8e3ca553837b80268559959ebc50d
SHA1 4340de528bdd1d115d13c53afc1f88a149e5816f
SHA512 caad3cb5b4593f07e16c532bf1010e9d98bbc239d4a33323197fffdc1caf65f8161e8564c25d1d7b8abe5d6765cabfd5cab2b52689488b5e66e240c92e76e375
SSDEEP 98304:6mSWOiIyU8CuD84/YBJZ4doXB8wVLUjH5oxFbx:6XyBdoXB8wVUjZEd
TLSH
T16A061203FB9585E2C2990575AF504286973AF961AA0B13833A8C031DCF577CB9F66F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4432	82F2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_91f8e3ca553837b80268559959ebc50d_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82F2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4432	2564	2026-07-19_91f8e3ca553837b80268559959ebc50d_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_91f8e3ca553837b80268559959ebc50d_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_91f8e3ca553837b80268559959ebc50d_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\82F2.tmp
  "C:\Users\Admin\AppData\Local\Temp\82F2.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-19_91f8e3ca553837b80268559959ebc50d_amadey_elex_njrat_smoke-loader.exe A7669A589903DA7099E3F10669D4E512A71FF78242EB369671548040C873369073BDC792EEF156664712D362E1965D0A1DE6C0C9ABE79E11D9299F88B1C64ED7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

82F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\82F2.tmp
Size 3.5MB
SHA256 0ecbec7e79bbda8d29fe9cfe71b73fa75e38a88d6b937002ab201a0ff6bc1e53
MD5 cadd93f5b8fee44a6aa4e454b8b596e6
SHA1 d45fe9918955c0aff13a2135788f9fa3c86302d1
SHA512 ce00074466c197860e3e014d9ac379c56577381400d9450de19bfc7c5884ab9e604aa2b3a8cca543983a1c2cb9789378050a63f2f07c1fc850754410f9641589
SSDEEP 49152:mvm22OdWOXqrbIyUJV4w85ytRsTdrO4NcwLVT5kUvgJSgHT6ojkxFbxLWC31:6mSWOiIyUt8EKs4N/VLUjH5oxFbx
TLSH
T11F061243F79185E2C25915796E514286933AF932AA0B53823E8C030ECF577CB9F66F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download