cf60e61890a76f4ee870457090c6cb0397e7920772448d835d9c03ed5444ca00

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_4cc62967600779cad1de1103c9e77774_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260730-d3qphsyeja
SHA256 cf60e61890a76f4ee870457090c6cb0397e7920772448d835d9c03ed5444ca00
MD5 4cc62967600779cad1de1103c9e77774
SHA1 ad48e306db425116461e54e70f3ab1f93975cc42
SHA512 dcff96263348bbb064070895a9e32416c7f71d07acc3d06baf740aec08b331ef2a4d6c928b832556a87f8a22be0356b992ba8874473c808de2e320c6a72c9cc2
SSDEEP 49152:doa1taC070UKV+MDKwfbnXWs6Hr9752Mqt:doa1taC0StKwfrWGMq
TLSH
T11CB5EF03E3509CE2C3D80575EE40C2615726B86DABF70672798C13DEFF567867E22A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2456	8F84.tmp

Executes dropped EXE 1 IoCs

pid	Process
2456	8F84.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_4cc62967600779cad1de1103c9e77774_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8F84.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2456	1468	2026-07-30_4cc62967600779cad1de1103c9e77774_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_4cc62967600779cad1de1103c9e77774_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_4cc62967600779cad1de1103c9e77774_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\8F84.tmp
  "C:\Users\Admin\AppData\Local\Temp\8F84.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_4cc62967600779cad1de1103c9e77774_amadey_elex_njrat_smoke-loader.exe 88A0EF249A0A82C8F70B7601A89F425D27B6C94C2F65517ED25735A3574732E741CE6ACD72615793524A065024A15E9A2975F834C1099AA4DB00AB08E8981450
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8F84.tmp

Path C:\Users\Admin\AppData\Local\Temp\8F84.tmp
Size 2.3MB
SHA256 ae6d194d367801f9b77f2ff8fdd64523284d076e25b6568fb1c7450d3cc6b938
MD5 7ab1d13bbc0427eb9de2de67cb18c9b6
SHA1 4e938e81323d0cb46bd8cb50a0350847097f411e
SHA512 66fc68a2d45710aa6cea9f53cac8e79d7d6edb8a999686b1cf0952386c7fe1d82204d955fdd2ef9e311d5a562d9d7ca6f75b4cd0bc4c7599591066cca5caa1e6
SSDEEP 24576:42oo60HPdt+1CRiY2eOBvcj3u10UoKnrNDkqpZOUOp2a1dg/wZxL5RC00Ti2Atuq:doa1taC070UFrVIp2a1d6wHL7Z0KAB
TLSH
T16AB5E003E2518CE2C3D90174EE50C261572AB86DABF70672794C13DEBF537867F26A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download