c4638fa8ed10ac3d350310683a6bdcd5f2c3bb3de3856e5e5332dd7d82c86d6b

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe
Size 3.3MB
Sample260727-halbjsxcjf
SHA256 c4638fa8ed10ac3d350310683a6bdcd5f2c3bb3de3856e5e5332dd7d82c86d6b
MD5 8f065d366791ac67425f4defcf79e51c
SHA1 f679ba9cb24461f235160d59e84244ca033db423
SHA512 6eb6e549d16303ee74e47360fabb1033ae0103ee0336ddaea9c75cc5c9525a65947c57de491be1dc4db637d7d63c342ccd68b16c4d56488a5d08636aaad3d94f
SSDEEP 98304:kmSWOiIyUPkrGFpi2NpqFVEnbuIK9VLUjH5oxFbxQ:kXRKAaLpVUjZEdQ
TLSH
T17FF512017718B4F3C2216AB4788697D793317C7B7B509AC72D84235E8CAB6D8AF17B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3032	51B0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51B0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3032	3536	2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Users\Admin\AppData\Local\Temp\51B0.tmp
  "C:\Users\Admin\AppData\Local\Temp\51B0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_8f065d366791ac67425f4defcf79e51c_amadey_elex_njrat_smoke-loader.exe 0D5D6063C909CD92D253DD4591A7D4601ABD13783C5EEA16E62DAC104E164ECCDE41191498D5341AB200D7019E836F267A95B6A1ED9E97AC2F843A61D0D82B73
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

51B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\51B0.tmp
Size 3.3MB
SHA256 b5940b77a209e9b0da50ab4950d8178c61c2c08551ce0d089ef9c0caa1e5b4be
MD5 78437905b7dbee7b2387cb84e248fb09
SHA1 cf8e3756d8c64b5846dd3f40d77393c49584a949
SHA512 59ffd29c790c5161ff49e100677da52338b300f1ea50a425e57c1e62055461b429ee7edd7677cfadb35100daea57047442d83bbddae91d541c26977480b922ca
SSDEEP 49152:kvm22OdWOXqrbIyUJV5XUs/yBECJK3RniCquIxLYJwLVT5kUvgJSgHT6ojkxFbxQ:kmSWOiIyU1XOW5ihuOVLUjH5oxFbxQ
TLSH
T174F512057714B0E3C2216AF4A89697C793217CB77F119AC72EC4234E8CAB6D86F67B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download