55c9154cd2dc972b6d2f1484c10614f2c5c524f33d8f3fae9e31a2eb3b965b31

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_9d591dfb3b38373e2247f48ef73a8578_amadey_elex_icedid_njrat_smoke-loader.exe
Size 3.7MB
Sample260825-22w2xabb52
SHA256 55c9154cd2dc972b6d2f1484c10614f2c5c524f33d8f3fae9e31a2eb3b965b31
MD5 9d591dfb3b38373e2247f48ef73a8578
SHA1 09e4d8bfc5a0a1227818114117d583b605725b79
SHA512 fc66247f120881d4cf0ba203b1b7c88d08e473d54bfbb532e329b528bee96ecc6b09894dbbd521bea86f4f6911febcd02e2b4724e58d765eecdfbdcf8017a97a
SSDEEP 49152:Nvm22OdWOXqrbIyUJVNYE1vFKGCns4JyhrRnR2S8OjGoOQzwLVT5kUvgJSgHT6oR:xmSWOiIyUFIGYJu+9kAVLUjH5oxFbx
TLSH
T1F5060103B7558CD3C3D14A74DC50C2A29721B86D9FF35A73798813CDBC6A294BEA6B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3644	2754.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_9d591dfb3b38373e2247f48ef73a8578_amadey_elex_icedid_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2754.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 3644	5380	2026-08-23_9d591dfb3b38373e2247f48ef73a8578_amadey_elex_icedid_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-23_9d591dfb3b38373e2247f48ef73a8578_amadey_elex_icedid_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9d591dfb3b38373e2247f48ef73a8578_amadey_elex_icedid_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Users\Admin\AppData\Local\Temp\2754.tmp
  "C:\Users\Admin\AppData\Local\Temp\2754.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-23_9d591dfb3b38373e2247f48ef73a8578_amadey_elex_icedid_njrat_smoke-loader.exe A89E8FE083BB2FF4F549B6119E394A8C5C2070647701F46AB80768F7D802EB1FFFB36CFCA997FC29A09395C79A5B7CCDFCA13F2E32FD881A1770F274610EE593
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2754.tmp

Path C:\Users\Admin\AppData\Local\Temp\2754.tmp
Size 3.7MB
SHA256 2dc61f8acb1b2dbc717a72b7786e5e2fb2f0cccd58721ad86fc01d499650c73b
MD5 4dda24facbfa77851a71355adb68c49a
SHA1 5b1184cd1675f959b82b9337bc66066721304b93
SHA512 de291412d40e405d66556f3c6802a1359ff1188eba3271b0d2a72def11a7d0eb5ad4e482be82557bce474bf4077972cce5df4a63353fc9da9c31537b15beea55
SSDEEP 49152:Nvm22OdWOXqrbIyUJVfZ10q/ovSM+YpWHXwgWZwLVT5kUvgJSgHT6ojkxFbxLWCk:xmSWOiIyUrZpoof5WCVLUjH5oxFbx
TLSH
T13A060107B3558CD2C3E14A74EC50C3A25721B86D9FF35A73798813CDBC6A294BEA5B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download