628ee82b3c31284d5570c56565368d44487a0c000d0414f2d61839efcda7f67a

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 19:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_7177671be5baeaf17f5e115312c132e0_amadey_elex_icedid_njrat_smoke-loader.exe
Size 2.4MB
Sample260724-xy78jsdf56
SHA256 628ee82b3c31284d5570c56565368d44487a0c000d0414f2d61839efcda7f67a
MD5 7177671be5baeaf17f5e115312c132e0
SHA1 d6023bf7e95373c9d1197b8dc29a8470dd04eeb3
SHA512 fadfe40d7a09895ef127433d2629942debc25badbae00d85d9034e8328c596fca2732160f5fa02ccac20e598f6169dee1a67402eb6b59d1137b5fa15c6511c3f
SSDEEP 49152:eoa1taC070UZHdN8xomBVF8HdzRhXzoixUsZ6MJ0T:eoa1taC0v9N8xtBVqdzT0S
TLSH
T117B5F103F79189E1C5A90A34AA1042D1663AF8616E478F537A8C131ECF777C68F66F39
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6084	8EF.tmp

Executes dropped EXE 1 IoCs

pid	Process
6084	8EF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_7177671be5baeaf17f5e115312c132e0_amadey_elex_icedid_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8EF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 6084	2760	2026-07-24_7177671be5baeaf17f5e115312c132e0_amadey_elex_icedid_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-24_7177671be5baeaf17f5e115312c132e0_amadey_elex_icedid_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_7177671be5baeaf17f5e115312c132e0_amadey_elex_icedid_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\8EF.tmp
  "C:\Users\Admin\AppData\Local\Temp\8EF.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-24_7177671be5baeaf17f5e115312c132e0_amadey_elex_icedid_njrat_smoke-loader.exe 544903E0B6F4BA3A21CFE468981E397BE2BE1B299A5DACD69F6F811084AEC8CD38D51616236C4E1F74D69025F92BDFFF43D2FB8488BAE01C5C54237D351FEDCF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\8EF.tmp
Size 2.4MB
SHA256 4e8f3049067c0a0795227f6cff747b6d41c4a15952b227423440e46d08a0b5c4
MD5 53bc69e073257dcd3f3279b00de6ba8e
SHA1 86ce76c9545fdd0baea504d08dca30ae27fcc225
SHA512 5dba01c4ded2ff90f4025a086a95d5c6236e1aacc1ecce6fd0f3d0d48d6e53badb3d8320a3330bb8cf37ac3a4eeb6045f7bb949b64aa4a9d375f7ca31e70fece
SSDEEP 49152:eoa1taC070UeGHq7gJOz/YOvxyHUuCPCVVoHkni7uT:eoa1taC0BH1OzHvA0BCzoEni
TLSH
T1F8B50103F79189E5D1694A70AA2082D5573AF8316E074A537A8C131ECF77BC68F26F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download