c4638fa8ed10ac3d350310683a6bdcd5f2c3bb3de3856e5e5332dd7d82c86d6b

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe
Size 3.3MB
Sample260727-halbjsxcjf
SHA256 c4638fa8ed10ac3d350310683a6bdcd5f2c3bb3de3856e5e5332dd7d82c86d6b
MD5 8f065d366791ac67425f4defcf79e51c
SHA1 f679ba9cb24461f235160d59e84244ca033db423
SHA512 6eb6e549d16303ee74e47360fabb1033ae0103ee0336ddaea9c75cc5c9525a65947c57de491be1dc4db637d7d63c342ccd68b16c4d56488a5d08636aaad3d94f
SSDEEP 98304:kmSWOiIyUPkrGFpi2NpqFVEnbuIK9VLUjH5oxFbxQ:kXRKAaLpVUjZEdQ
TLSH
T17FF512017718B4F3C2216AB4788697D793317C7B7B509AC72D84235E8CAB6D8AF17B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3896	4A04.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4A04.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3896	1152	2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\4A04.tmp
  "C:\Users\Admin\AppData\Local\Temp\4A04.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe 6A6DC357EF18B622636C79A5479169C54DF128D7EAFFEB290712AE908C8540CD8625F983903735047896374983E39F7796FE4F2A6D7EFC1F9643B1FA2903A442
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4A04.tmp

Path C:\Users\Admin\AppData\Local\Temp\4A04.tmp
Size 3.3MB
SHA256 00f33481fdc86579b41ab3506acb536b718393ef82435539b150717143703542
MD5 af401227318752c1c1cf6f38d032a109
SHA1 808d7fd436cd9554c36e4ac1cebf4ed00e01d5dc
SHA512 a8b117208436999314bdaa1af4e0b7e8c10b56b05bb08c8b71b8067d8061cee864ad22ef2a3dafb82c7e42c5f7507165f63962c2281873c8b37457497b87f65d
SSDEEP 49152:kvm22OdWOXqrbIyUJVYdtr5VKJgo5CHOq0Tub4h99awLVT5kUvgJSgHT6ojkxFbi:kmSWOiIyU0X5agr0Tf7VLUjH5oxFbxQ
TLSH
T180F512067754B4F3C2116AB0688687C793317C7B7B21AAC72DC4235E8CAB6D8DF66B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download