f13c27cb93d7b07a48f14699b8106d09684d5ddc3f85c10ad2dc23b47036bb92

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_ea3878d76b510ad8f8ff54a3dfad0fa3_amadey_elex_njrat_smoke-loader.exe
Size 3.2MB
Sample260809-x39beaxvgw
SHA256 f13c27cb93d7b07a48f14699b8106d09684d5ddc3f85c10ad2dc23b47036bb92
MD5 ea3878d76b510ad8f8ff54a3dfad0fa3
SHA1 7e0aa209983c1c93d43d6957fac0636364a0ed75
SHA512 e34eb0cb96553a98990facf42a85b0f1efa1f2d968e15ec193f0cee72c9dcdabce13f674b56b6a9d5f01491d2bd59e4a048015dd726e6df3eb22fd8ccb513f63
SSDEEP 49152:zvm22OdWOXqrbIyUJVtdUiQCRjsRYB19mky3ywLVT5kUvgJSgHT6ojkxFbxLWC3:zmSWOiIyUZ5QCwQ1OpVLUjH5oxFbx
TLSH
T15EF5230577A4D0E2D1516EF4B49187C6D6323C7ABB120AC72FC8131D9C6A6F8AF67B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1412	A936.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_ea3878d76b510ad8f8ff54a3dfad0fa3_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A936.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1412	2248	2026-08-09_ea3878d76b510ad8f8ff54a3dfad0fa3_amadey_elex_njrat_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ea3878d76b510ad8f8ff54a3dfad0fa3_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ea3878d76b510ad8f8ff54a3dfad0fa3_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\A936.tmp
  "C:\Users\Admin\AppData\Local\Temp\A936.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-09_ea3878d76b510ad8f8ff54a3dfad0fa3_amadey_elex_njrat_smoke-loader.exe DC191C3E838DBD624F108638062F8FD44200D03376FA22B06E2792DD2BAE8C3640EC69F0B1F75EEE8A434ED7B1DF788AA3316DD655422ED5735D69590831D20E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A936.tmp

Path C:\Users\Admin\AppData\Local\Temp\A936.tmp
Size 3.2MB
SHA256 fd89652ead12f6a8b1074740b75c7c73e3c02d6f53aeab49e77839d473729207
MD5 0d3580489b95014ef9d46c7c713efd73
SHA1 83e1ce56032c6fbb0eac991065d71d1f5b399a1f
SHA512 0ce67518da49db5f78c6627264f6c0dbce52893bcb3e877e2a5bc223b3fbe48eb33c95eab7aebf205a36d756940cf0c935ca90094dc73cab750436621bd9b818
SSDEEP 49152:zvm22OdWOXqrbIyUJVbnLt1xHOjnLexS7FpATYMIVwLVT5kUvgJSgHT6ojkxFbxz:zmSWOiIyU/wDL+SRpATVVLUjH5oxFbx
TLSH
T169F5230977A4D1E3C1625EF4B85283D296327D767B510AC72EC4130E8C756F8AFA7B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download