7409afb0a0cc17c402318e9e90133e3a13cd818b2ccf5512060c9622ccc28e73

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_341922044acdbc73b16d2ba8082c0670_amadey_elex_njrat_smoke-loader.exe
Size 3.7MB
Sample260720-l6331ses9j
SHA256 7409afb0a0cc17c402318e9e90133e3a13cd818b2ccf5512060c9622ccc28e73
MD5 341922044acdbc73b16d2ba8082c0670
SHA1 a457b721a5c1b12bdfc8abbb125872f38fca9316
SHA512 677da588753a459dc03a1a4eb807b80d98021d1e76ddcfe158d6bb8cb0fa312b11cac22df1a3a9c841f1328cc0dcb2af7a6734867308bc553ee38860ca2e4104
SSDEEP 98304:VmSWOiIyUyLAeHLWZsOHV6EGCVLUjH5oxFbx:VXALmZj/VUjZEd
TLSH
T12F06E003E7818DD6C3C90575DE10C295932AF92DABFB5272398C120DEE53787BF65A28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1968	76EB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76EB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_341922044acdbc73b16d2ba8082c0670_amadey_elex_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 1968	5368	2026-07-20_341922044acdbc73b16d2ba8082c0670_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_341922044acdbc73b16d2ba8082c0670_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_341922044acdbc73b16d2ba8082c0670_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Users\Admin\AppData\Local\Temp\76EB.tmp
  "C:\Users\Admin\AppData\Local\Temp\76EB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-20_341922044acdbc73b16d2ba8082c0670_amadey_elex_njrat_smoke-loader.exe CBB8A49D6563433C10695E2E161B1E67028600F131D7101FA0341DA9D5B6CAA59DC08EFE5D5C94860D19959BA2BE2A2B006340FEAC03E6938FC41A4C65E11DC6
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

76EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\76EB.tmp
Size 3.7MB
SHA256 25986779447af40632cf597451a5615562b7d5e23b599b7beffeb22950c21c72
MD5 b0ed5a56d50c9ce8ef9a77d31994f44b
SHA1 b0e9cc142ef9774f3ff2a3a8969787525da9fda4
SHA512 c767bef2582dfb42a5256045f5f47cacb565884ac8197913b8694f83ef064e73b2c774b0dfae1bac9246d027221f57beaeb78655cc5c501c2260b1f623197aad
SSDEEP 98304:VmSWOiIyUyASWDcR1hTu9cj+VLUjH5oxFbx:VX+WcbTcVUjZEd
TLSH
T15206F003E7818DD6C3C90575EE108295932AF92D9BFB5272398C120DEE53787BF61A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download