1e5e7d57a28ed5fa5105f6a9e1997112ad1c7feead0b41c182aabd5182546175

Analysis

max time kernel
149s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_3a4017a3c48f59c841531bdedf0852f2_amadey_elex_njrat_smoke-loader.exe
Size 3.3MB
Sample260729-2sndeaxtgs
SHA256 1e5e7d57a28ed5fa5105f6a9e1997112ad1c7feead0b41c182aabd5182546175
MD5 3a4017a3c48f59c841531bdedf0852f2
SHA1 b7a72032fb969bbcadb6fe03479671d6c84c036e
SHA512 f7d2ffe364d7f949ba4581a04c3689bacf9c2c9ae51356bffe81957d100c0296c4d37025cd59be157df625c77fdc8a9fc59a77e229ca520032a68fb26340bc05
SSDEEP 98304:kmSWOiIyUiHxAkZVmFTPSoV2m9fVLUjH5oxFbxQ:kX8HxSbdwm9fVUjZEdQ
TLSH
T1A7F512067B14B0E3C2616AF4689687D792317C7B7B5199C73DC4230E8CAB6D8AF63B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4512	212F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_3a4017a3c48f59c841531bdedf0852f2_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	212F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4512	1416	2026-07-29_3a4017a3c48f59c841531bdedf0852f2_amadey_elex_njrat_smoke-loader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-29_3a4017a3c48f59c841531bdedf0852f2_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_3a4017a3c48f59c841531bdedf0852f2_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\212F.tmp
  "C:\Users\Admin\AppData\Local\Temp\212F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-29_3a4017a3c48f59c841531bdedf0852f2_amadey_elex_njrat_smoke-loader.exe 2620C256E3D3A608AE1EC04F682222D92666CED55EE5EA82E8088B7E98645B52EEFB6F68ED9D78D7E1E3036E81B3CE8E5FFA6337FB84B6A1E807988CAF1B5B19
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

212F.tmp

Path C:\Users\Admin\AppData\Local\Temp\212F.tmp
Size 3.3MB
SHA256 b3b7b1ab5ac581ffae03ae87c8c70955abd998cd0bf5ca2352bd366275b3020c
MD5 5a3048c1a18614cd6546ba741741231a
SHA1 a241ffab08c18f5dc8498dc967b52f76f9855ba8
SHA512 47d393e52fe9a3e152458400b32e6e3ca56d01fbd47f500994b243478c9309ab66835b6cedad740f5c0f0e427492060ea208142f9d56619c70e2c76db0af9d7a
SSDEEP 98304:kmSWOiIyUM5jPErosK+TvV/FVLUjH5oxFbxQ:kXKH30VFVUjZEdQ
TLSH
T151F512067754B0E3C2516AB4A84687D797307C777F51AAC72DC4230E8CAB6D8AF27B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download