099a6e6dc0fceb4a9bfef80c9ec84047ac4564725d40e49f95396058661f8238

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_7c9b6575762279f898d630919f5f92e5_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260730-ds3w4aycla
SHA256 099a6e6dc0fceb4a9bfef80c9ec84047ac4564725d40e49f95396058661f8238
MD5 7c9b6575762279f898d630919f5f92e5
SHA1 bf2178275c71383ba034e794571762494f9f9569
SHA512 fe475ab885227d957d7dcbddbb0f901d5999c0708913866bf30cfea6e73d322f07b5b36a2e0d7ad825a5955d3fe4201717f8ddc5e9fac4f4698dcd7ce8c3505b
SSDEEP 49152:joa1taC070UZ6pOyWfTp1LJVON3UfXH2ZFeY0ST:joa1taC0kOyWfl1LGl2XYFWS
TLSH
T12FB50157F78085E5C66D06769B608291923AF9326A0B568279CC130DCF53BCB8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4912	2F34.tmp

Executes dropped EXE 1 IoCs

pid	Process
4912	2F34.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_7c9b6575762279f898d630919f5f92e5_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2F34.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4912	3872	2026-07-30_7c9b6575762279f898d630919f5f92e5_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_7c9b6575762279f898d630919f5f92e5_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_7c9b6575762279f898d630919f5f92e5_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\2F34.tmp
  "C:\Users\Admin\AppData\Local\Temp\2F34.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-30_7c9b6575762279f898d630919f5f92e5_amadey_elex_njrat_smoke-loader.exe DE1AB31DF639A7B960BB1E254D6412682EBBB35CE39EDE3574E8A6CBADB612ADFC8EE9380E5F2C49C3E9397C163A57422CEEC1B43D5196F7E6A33E1B0A9E3D30
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2F34.tmp

Path C:\Users\Admin\AppData\Local\Temp\2F34.tmp
Size 2.3MB
SHA256 6005f24b40ed31c527aefa69b75b3872c2fbe7a24a08afd81f90d24b2e2ae073
MD5 5fcc69b4429f68456bd3b5170c9b4920
SHA1 a3e41c61ab3c29027f76e36a0ca45b447034b735
SHA512 8d88ebf00f3e4fb6963724a308f77802a9b5358dd8da2962adee6cc8144a158c47f316a91a7b3770cb89a18ccf6489663e82d53f6bc130f81fe836c33cae9516
SSDEEP 49152:joa1taC070UGPL4xlLxEX1K8xWKvHh96bg370/uBh42TGn2:joa1taC0oT4rxElK8gaHhcgrkuB+z
TLSH
T16FB5F157F79586E5C29D05369B608291923AF8326B0B56427ACC131DCF53B8B8F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download