962245b86e0e52584de0868e55a5204527d7990874c92dc29379867e201d28d8

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_c253017e6629dbf11bb9716756eac0fc_amadey_elex_njrat_smoke-loader.exe
Size 3.2MB
Sample260809-x8a1ssxwez
SHA256 962245b86e0e52584de0868e55a5204527d7990874c92dc29379867e201d28d8
MD5 c253017e6629dbf11bb9716756eac0fc
SHA1 97237dbfc9c4a3245c7b1a15ee54b32bdb64b02a
SHA512 f7094e15f060157f519de423b861abbd828324292c77d6542c2e388a8ba248d5d5acf0c1ead026180f0b2cff92148287122488dc9798161f8d22f894faaf352f
SSDEEP 98304:zmSWOiIyUFRS+AYocFyxgxVLUjH5oxFbx:zX/DABQGgxVUjZEd
TLSH
T1DAF523057795A0F2D1521EF4789587D696323DB5BF200AC72FC8230E8C656F8AF6BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5696	C104.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_c253017e6629dbf11bb9716756eac0fc_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C104.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 5696	3520	2026-08-09_c253017e6629dbf11bb9716756eac0fc_amadey_elex_njrat_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-09_c253017e6629dbf11bb9716756eac0fc_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c253017e6629dbf11bb9716756eac0fc_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\C104.tmp
  "C:\Users\Admin\AppData\Local\Temp\C104.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-09_c253017e6629dbf11bb9716756eac0fc_amadey_elex_njrat_smoke-loader.exe 1C5CDDFA44FEA031B2B67225822845B95B01ADB2A6064C38A80D897C27F6D2F1F31613CF614242CF2058202E1580686EEFE4DA9DDF0392DB28C4BAC31E07B2B3
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C104.tmp

Path C:\Users\Admin\AppData\Local\Temp\C104.tmp
Size 3.2MB
SHA256 b9d8055ae436f568ac47dc9950f4f9d3384a09a890a1b62e2dcc57bf3e312815
MD5 dc54ff3f803eba9bd1cb2aa0adf21844
SHA1 2d4b1b8d2c5db2243d3f06951da9f2ac4847e0b5
SHA512 b6b1121d51d6ae69be153dd6667ae8f8e2964492c653d25e7b4e18f689d53acddad0162a59fbbbb340d0230533a859f45ea3c7170e5ec7ea6d44a3c1277f1928
SSDEEP 98304:zmSWOiIyUSM+YgQtPJhRSQNUjy60tVLUjH5oxFbx:zXgrlFN0tVUjZEd
TLSH
T124F52305779591F3E1525EF4788283D2D5313D66AB204ADB2EC8131E8C266F8AF7BF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download