44ad51754c4079a5a44331916bad6ef54078309b6ce1d395c32fd73671282515

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260727-relmjsfp4z
SHA256 44ad51754c4079a5a44331916bad6ef54078309b6ce1d395c32fd73671282515
MD5 e62ebcff32264274fc2a0c5de1945c9f
SHA1 b6b935124a8491fad5dd960adb46b4d288a17ed1
SHA512 d5983411151e7891d9459ea4b1cf1c6c2048a1ed6bf9adda224b1295e8226dfcf35ea00013edb9fe6d8d9014ae2e916622be9b1c146ad0acd50a0deec184755b
SSDEEP 49152:joa1taC070UMcZglxgUt5eNFQhqUppTNa308R7hwUb:joa1taC0mc8nYNFNUpTgI
TLSH
T1DAB5F113F79196E5C29D06765F608291923AF9326A0B5782798C131DCF53B8B8F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
248	84A7.tmp

Executes dropped EXE 1 IoCs

pid	Process
248	84A7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84A7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 248	616	2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616
- C:\Users\Admin\AppData\Local\Temp\84A7.tmp
  "C:\Users\Admin\AppData\Local\Temp\84A7.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-27_e62ebcff32264274fc2a0c5de1945c9f_amadey_elex_njrat_smoke-loader.exe 2A415FACCDFA2F23DD0A4FA7E6D44F9A0F86F047E3E12D32A7862ACB38915984D96D6C7B141B04A71FD97E8B78F6D5C4F7CC93247F665EE34B0A30D83B7C4EFB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

84A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\84A7.tmp
Size 2.3MB
SHA256 0b99baa25474f307270a5a7e661a1016947578b42f6f1795b9b521d7398f36a9
MD5 b25fd42f14080dabe36d161e48015461
SHA1 a60c1d40f339ec99417d02c00e5f05ba7459eba8
SHA512 6694028af5a63637662357e8cb769f12af15e72a076f140deac657259b62f76538df94cee0114dd83d605618a5927c453b2bc7ff98da4d807a5450f98566ead2
SSDEEP 24576:a2oo60HPdt+1CRiY2eOBvcj3u10UgAWy++maVwW4vTIabIaczvRdOEGFFP0FFmAg:joa1taC070UgAWyOW4L1IacF8tRx
TLSH
T119B50113F7918AE5C69D45369F108291963AF9325A0B16427ACC131ECF53B8B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download