445d8d36e0284d05fd4334eb8da8645440ada6fc7b2eac50eddfc583069a07cc

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_7729c1234cf79383cf17f8fdc9422350_amadey_elex_njrat_smoke-loader.exe
Size 3.4MB
Sample260803-c1jmrawhrf
SHA256 445d8d36e0284d05fd4334eb8da8645440ada6fc7b2eac50eddfc583069a07cc
MD5 7729c1234cf79383cf17f8fdc9422350
SHA1 f7e23de5b3d755f176f0907137a798323bdf7cc2
SHA512 7801c265787d5afcfc1d52aca6810e4800e649e2c78cbd273a5531df145783f8e5e738d16761c87ad9de572aa92832f79c29c0324676e5197b8c108656a7db7f
SSDEEP 98304:UmSWOiIyUmDAhDd93a4winwLVLUjH5oxFbxm:UXbd9KI+VUjZEdm
TLSH
T1F7F51201B71474F3C211AFB078969BC7A2213CA77B5199CB1D84235E8CDA6D8AF57F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4168	F632.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_7729c1234cf79383cf17f8fdc9422350_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F632.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4168	3404	2026-08-03_7729c1234cf79383cf17f8fdc9422350_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_7729c1234cf79383cf17f8fdc9422350_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_7729c1234cf79383cf17f8fdc9422350_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Users\Admin\AppData\Local\Temp\F632.tmp
  "C:\Users\Admin\AppData\Local\Temp\F632.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-03_7729c1234cf79383cf17f8fdc9422350_amadey_elex_njrat_smoke-loader.exe 05FCE2DA6AED21E09B21567E18DB09801B62AA0AD1200BCFD115BA33CA672AD01492037B205C8141B15C60348482B2EFB79BE1C4EA7803DA6CCC9C44CAFFE03E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F632.tmp

Path C:\Users\Admin\AppData\Local\Temp\F632.tmp
Size 3.4MB
SHA256 42019ad438a948624552e74b127a738779525f52487276b6d123d62121e3f4d9
MD5 d198dee283ac3ce57065d0d82cb92e11
SHA1 e05ba526b6a8aabe5eef67503032f06ae0d12224
SHA512 b0c52905f10f0a4e41cedd8a36c027c0a22f43c114a1f4f6d50969694243a53691f9c43cd4ddaaf60a93a1c3027139b07405ff317f1ee576f3b9ddab9cdbc4eb
SSDEEP 49152:Uvm22OdWOXqrbIyUJVN4ZqJt8nyADiFPV3D6tVboCbnbwLVT5kUvgJSgHT6ojkxC:UmSWOiIyU6o6DiFGb4VLUjH5oxFbxm
TLSH
T1A8F51201B714B4F3C211ABF0689A97D7A2217CB77B1099CB2DC4235E4CDA6D8AF57B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download