44ad51754c4079a5a44331916bad6ef54078309b6ce1d395c32fd73671282515

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260727-relmjsfp4z
SHA256 44ad51754c4079a5a44331916bad6ef54078309b6ce1d395c32fd73671282515
MD5 e62ebcff32264274fc2a0c5de1945c9f
SHA1 b6b935124a8491fad5dd960adb46b4d288a17ed1
SHA512 d5983411151e7891d9459ea4b1cf1c6c2048a1ed6bf9adda224b1295e8226dfcf35ea00013edb9fe6d8d9014ae2e916622be9b1c146ad0acd50a0deec184755b
SSDEEP 49152:joa1taC070UMcZglxgUt5eNFQhqUppTNa308R7hwUb:joa1taC0mc8nYNFNUpTgI
TLSH
T1DAB5F113F79196E5C29D06765F608291923AF9326A0B5782798C131DCF53B8B8F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
972	3832.tmp

Executes dropped EXE 1 IoCs

pid	Process
972	3832.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3832.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 972	2732	2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\3832.tmp
  "C:\Users\Admin\AppData\Local\Temp\3832.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe CB5FB6873705D749B922857BCDFE48C227E55D2F1552264BB06ABDF0A4C95E0AAF8CE1D99E147DB1CBD3EEE600908CF902A1BEF96DAFE4D72C03C17A850978BE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3832.tmp

Path C:\Users\Admin\AppData\Local\Temp\3832.tmp
Size 2.3MB
SHA256 3cca7dbc7a44e5f5a09f9fc5c47aa24d907adcedcd6f9694c563c95e4810ff23
MD5 7ca8d4fd318ebc9d8b767227c034e954
SHA1 63303ac746c608c96e54aa145554d08254285103
SHA512 f9bab32ead3de20b7d096af5bc78f7d7f292a09e1066331897a355ab78c20f9e2203c35bfd2ee8b2c97c8f938cf9eb0f223d20c413a8668c2f10dfbb32d67a35
SSDEEP 49152:joa1taC070UjkWgtwIelI9xD7oFjn78BXdg70BB6Vd+:joa1taC0NgKnIfejn78nBBBa
TLSH
T1F5B50143F79195E5C69D0576AB608291923AF832AB0B5782798C131DCF53B878F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download