4b355e22f0492b7fa23ba015bd756e24d6afab3ab26fba61ec2301c691d940dc

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_929a6b748513d79502414c2c2d711d96_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260730-dpvrba1zez
SHA256 4b355e22f0492b7fa23ba015bd756e24d6afab3ab26fba61ec2301c691d940dc
MD5 929a6b748513d79502414c2c2d711d96
SHA1 8c730b196a38f2312e3832832990ff34b19fd708
SHA512 9c3cb3b25d33f27dcc64230108bb21d2575f12cf026e368ade5c3e8522f19a796985a22d2e5307899da44f123f5ea7a5ffce6171bee5e55eade4819c76625268
SSDEEP 49152:doa1taC070U3B39qbZegTKrFog7PFglL:doa1taC0pBtcAJ3zyl
TLSH
T1FBB5E003E6418CE2C3D80574EE50C2615726B82DABF74672798C13DDFF52B867F26A29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3852	E74E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3852	E74E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_929a6b748513d79502414c2c2d711d96_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E74E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 3852	5932	2026-07-30_929a6b748513d79502414c2c2d711d96_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_929a6b748513d79502414c2c2d711d96_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_929a6b748513d79502414c2c2d711d96_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Users\Admin\AppData\Local\Temp\E74E.tmp
  "C:\Users\Admin\AppData\Local\Temp\E74E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_929a6b748513d79502414c2c2d711d96_amadey_elex_njrat_smoke-loader.exe 58DDCA596A51AFEC0853FF5E210922478D603D01B1A910446D40118EE51D4B13011D6B659449733ACF5C66DF53A54051BE16A043573DD036D17F0FC62112091F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E74E.tmp

Path C:\Users\Admin\AppData\Local\Temp\E74E.tmp
Size 2.3MB
SHA256 8f5632df0089cfa40384cce09cc69e29e8989ceada2e50dec0f65a042cb7200b
MD5 e587ec18e4ed9c7f94639e2717d2db3d
SHA1 d7ddf0049fb9dd6a7b242260047c3b01a5bc6056
SHA512 e188485cec2ccd6fd696cac6ba6040b802a5479f772e02ad132cc33ac51b3a815f3c3b88895b49457690eeafe5b748e1d81d29bf67aca9d5e35825594866d458
SSDEEP 49152:doa1taC070UzshK68DD2CZ4hE6iMXMnddc5H:doa1taC0dsz0D2Q6iMcnI5H
TLSH
T1A2B5E003E3508CE2C3D90675EE10C2615726B46DABF74672798C13DEBF427867F26A29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download