eea5c4f2d3fb0a2e092791f9379344da19401168e6a8e2160816c57724780521

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260729-bxwbpsdd75
SHA256 eea5c4f2d3fb0a2e092791f9379344da19401168e6a8e2160816c57724780521
MD5 327643d92ced9e52d1fbc247f29d75d3
SHA1 048337a56b38e65789fe83c6d0486b1276a29a84
SHA512 00a052e183f07f6c7aec677187da0e84efa0717bc94fd3997088af8cbd05871c68c49d305874d29d492f8c5b52c433e67df82b9f9e41f8420a2e3504eb1085a6
SSDEEP 49152:joa1taC070U2QuIe0N/UnsR8Wl5njiwwWe5FP7iAutLKWwfqS:joa1taC0oQHUns5jiXWYFjiAuEtfq
TLSH
T171B5F157F78085E5C69D09369B108291963AF9326A0B56427ACC131ECF53BCB9F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4836	5C7E.tmp

Executes dropped EXE 1 IoCs

pid	Process
4836	5C7E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C7E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 928 wrote to memory of 4836	928	2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:928
- C:\Users\Admin\AppData\Local\Temp\5C7E.tmp
  "C:\Users\Admin\AppData\Local\Temp\5C7E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-28_327643d92ced9e52d1fbc247f29d75d3_amadey_elex_njrat_smoke-loader.exe 162EE811E428E56CD3002D6FD144C47656E037366D2DF81C11B45D4F7B408A81D3F0325BC2ACFBE40C2AF680408D05E806C6EEF599CFFD9540967C425B3F621E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5C7E.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C7E.tmp
Size 2.3MB
SHA256 618d485743ab60c76d77e19a961cc2e3cd491f3229a360af119a1c2be4a5ca49
MD5 391513c8bf5440cabac6fd95adedc18c
SHA1 9cc4a3b0191b62af81aa0bd28f1adc4271b7c288
SHA512 0f52b2acf68e8af346da94214a5453953ba9b36318c9d7d696c6f5687e07693a2070bf8d4ef5e63300cd04b1f3e95851b90d1684ad89abfd260a197534ad4449
SSDEEP 49152:joa1taC070U92uK7kocbq+zWsra7OBDLj:joa1taC0WuK7kocbda6l
TLSH
T1EAB5F157F79185E5C65D4A31AB608281922AF8316B0B5B42798C131DCF93BCB8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download