81347197e5cc575a705e6b9b1935cf2fe0307c83bab58901e2a324cd47aa9517

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_3c44de711bcdd6935c1ce66ead456e13_amadey_elex_njrat_smoke-loader.exe
Size 3.4MB
Sample260825-she5lstgrd
SHA256 81347197e5cc575a705e6b9b1935cf2fe0307c83bab58901e2a324cd47aa9517
MD5 3c44de711bcdd6935c1ce66ead456e13
SHA1 75ec4b6ea0e969089822404eaa7fb06639113c57
SHA512 baaab1c0c481c39db07ca45eaeee18827bd4570f0257b568dc34c5343e68a8ea28cdff37dda959b733232f1ac6e856a653de34ebd3422fa1b47c4e037c81852f
SSDEEP 49152:Uvm22OdWOXqrbIyUJVvXm1+9ReIXToCGZfJ3iwLVT5kUvgJSgHT6ojkxFbxLWC36:UmSWOiIyUT99sIjoCeDVLUjH5oxFbxm
TLSH
T1D3F51201BB14B4F3C211ABF0649697C7A2207DBB7B5199CB1DC4234E4CAB6D8AF57B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5152	769.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_3c44de711bcdd6935c1ce66ead456e13_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	769.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 5152	3008	2026-08-24_3c44de711bcdd6935c1ce66ead456e13_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-24_3c44de711bcdd6935c1ce66ead456e13_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_3c44de711bcdd6935c1ce66ead456e13_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\769.tmp
  "C:\Users\Admin\AppData\Local\Temp\769.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-08-24_3c44de711bcdd6935c1ce66ead456e13_amadey_elex_njrat_smoke-loader.exe 9939C9645F07E773FC457F2E9C61D793823EA747B4CE12D627F2D2FA42F07AF01091AF6CAE9C873DF5AAC820A10756372179759240EA9FD98DB3BBBC39D6BB18
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

769.tmp

Path C:\Users\Admin\AppData\Local\Temp\769.tmp
Size 3.4MB
SHA256 5b7dcca92139e66ec42a630692ed04da3f9b6c05c8f0e1770e7ac6bfa36a66f3
MD5 797805ad043179cd3442c83a6b44f066
SHA1 f128da7d112102a9f7504ebd6f54413f207245f2
SHA512 344dbbf1c15db4894aed783466c4757b8a1ae9580290ab92a87186dbb4ded82f80e282e3932311cb51648c4a1b7c0720ff52aea7af04090089c76fa16f264c0a
SSDEEP 98304:UmSWOiIyU8i2tGO8Bp3rzIyd5LVLUjH5oxFbxm:UXuh0BNVUjZEdm
TLSH
T1FCF51201BB14B4F3C211ABB0689697C7A2217CA77B5599C72EC4234E4CDB6D8AF17F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download