eea5c4f2d3fb0a2e092791f9379344da19401168e6a8e2160816c57724780521

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260729-bxwbpsdd75
SHA256 eea5c4f2d3fb0a2e092791f9379344da19401168e6a8e2160816c57724780521
MD5 327643d92ced9e52d1fbc247f29d75d3
SHA1 048337a56b38e65789fe83c6d0486b1276a29a84
SHA512 00a052e183f07f6c7aec677187da0e84efa0717bc94fd3997088af8cbd05871c68c49d305874d29d492f8c5b52c433e67df82b9f9e41f8420a2e3504eb1085a6
SSDEEP 49152:joa1taC070U2QuIe0N/UnsR8Wl5njiwwWe5FP7iAutLKWwfqS:joa1taC0oQHUns5jiXWYFjiAuEtfq
TLSH
T171B5F157F78085E5C69D09369B108291963AF9326A0B56427ACC131ECF53BCB9F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3152	A350.tmp

Executes dropped EXE 1 IoCs

pid	Process
3152	A350.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A350.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 3152	1700	2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\A350.tmp
  "C:\Users\Admin\AppData\Local\Temp\A350.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe CF0F80749681E0B0A447175A3B35E28D502D8C9237CD8D40953B16AA5EF6561360989808806429C385F393A4B73FB8863CE38D19B4FEACF878036E80893DCEEF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A350.tmp

Path C:\Users\Admin\AppData\Local\Temp\A350.tmp
Size 2.3MB
SHA256 e3072e0e8d95286e8b34f71a72876606184aaf903c10a56ec4ffd946938b4868
MD5 706795b030d311aef5d6fac836d869ac
SHA1 b018613ae6eb5bd10a882e071480475b0bbe0d1a
SHA512 77131a6bc6ec9f0be74745ff4649f91b6f5e97eeae0ae5cce54a87fe0057d3c2a95258847dc2da2e1f08c568fb2c05bf824fc9c2893e6f70c7c71bd09b88d18c
SSDEEP 49152:joa1taC070U8Yfjt6ySH+Lb3W3wKUaVMecGzB:joa1taC0CYfeIy3wVaVHz
TLSH
T10AB50117F79196E9C65D0576AB208291523AF8326A0B564279CC131ECF93BC78F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download