c78e8a0d94d0d6c79ca67856359b15a01082807e075aedde5178a9d420773608

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_f6d7168cf02fb8bd0ca6cf4dd2539d85_amadey_elex_njrat_smoke-loader.exe
Size 2.1MB
Sample260724-2mlydsvdjf
SHA256 c78e8a0d94d0d6c79ca67856359b15a01082807e075aedde5178a9d420773608
MD5 f6d7168cf02fb8bd0ca6cf4dd2539d85
SHA1 e39421c0de81cf992b1f3d09772a6b4964d04964
SHA512 f834fcc0e0596966600ba9f2e5a3011ac12568f5ccb136c0ccbd9ce7481796131d28e5b37d63592365be43556dabb56c8c7cbacf2feb5681bb5b36a75fecab48
SSDEEP 49152:Roa1taC070UtxV6wtfaKTYnTG8xK5lpt8ukbqSaCrdvOJFIg:Roa1taC0VtfvTYnif5ldbl
TLSH
T1BCA50205B754B0F7C6216FB0A595D6A792217CBB7B009DC729C4235E0C9BAC89F23F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4884	4D0D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4884	4D0D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_f6d7168cf02fb8bd0ca6cf4dd2539d85_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4D0D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 4884	760	2026-07-24_f6d7168cf02fb8bd0ca6cf4dd2539d85_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-24_f6d7168cf02fb8bd0ca6cf4dd2539d85_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_f6d7168cf02fb8bd0ca6cf4dd2539d85_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\4D0D.tmp
  "C:\Users\Admin\AppData\Local\Temp\4D0D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-24_f6d7168cf02fb8bd0ca6cf4dd2539d85_amadey_elex_njrat_smoke-loader.exe 482FF6063BB07A2624BA0280CB83F0773668A5A2A9CDD5DB038A359AEF5D2946A0EEBC9CB9BACCC812C7EA8588517C451897A1F063EAF7B8EC8352EB704C1826
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4D0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\4D0D.tmp
Size 2.1MB
SHA256 2cf83d87b497816b348b5a990f768b844ed87b34d89e730bf58dfe183d33cc54
MD5 d64f3692d62687c0824db1c0f5908ef7
SHA1 e49d9d838bd8509d2fd4e16d1025b7fbf22f89c8
SHA512 24390fb7a6fca2dc9756df23008e1ed84e717639df7e1af8c4cd82ec91ffe9680517b19fa9ddf28c7d75aacb7f59e8a2bb8cefabde77477922f9aacf8e82e655
SSDEEP 49152:Roa1taC070U1JaKlR67a0CSFEv99DbA5xNidvOJFIg:Roa1taC0ECSFEjoxF
TLSH
T1E9A50115B754B0F3C5619BB0A565CBA7A6216CBB7B419DC329C4230E0CDBAC89F53F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download