30b27dff590f334180ada41465b529483a30d033fa5514f522b3fe61f8715b5e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 19:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260907-xxdbsaah32
SHA256 30b27dff590f334180ada41465b529483a30d033fa5514f522b3fe61f8715b5e
MD5 692dd23df05945dba99fc5a86aaf54d0
SHA1 591a4e05e2479ff1f0ee456330fbd03338719d5f
SHA512 f38244dc14266fcba42cedbfa07bf6e56f95ce92e2ac5440cd78bb44b2216cab349513cf00e2c8c442afca5761461cfc78aa7b3355ef0de4943308265c8a9076
SSDEEP 49152:joa1taC070UxmmX6W2f6lWErCRMlU1BjbMD35IS:joa1taC0fmmKWzuRMlU1B09
TLSH
T1EBB5F153FB9086E5C65D45369B608291963AF8326A0B5B42798C131DCF53BCB8F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2384	2268.tmp

Executes dropped EXE 1 IoCs

pid	Process
2384	2268.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2268.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 2384	4912	2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\2268.tmp
  "C:\Users\Admin\AppData\Local\Temp\2268.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe 33DC68A061C82C0EF37AD85F8F3EEF1CB929163B23DF0CD73CE86215735ECB1204FE08B4C7B9D2D80A1BAE78A757DC43E5F9557454766305B7138B6898683A03
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2268.tmp

Path C:\Users\Admin\AppData\Local\Temp\2268.tmp
Size 2.3MB
SHA256 3516ec88ef78fc2be5a2b40745c58996a116746130ca8eceb03fd3c6eef1c3ed
MD5 355ca3574e91147c32e9bc321a123bf1
SHA1 256ad75f807ff0584f3979fe484916564809c08e
SHA512 a6052779b4c0ad81adaecf03ae365b8ff668f484710ed74d21750c930f5a8161ff66ca18334e7d0ba64661fc119e448e7dff4949b2662c2050a20a559194b0e4
SSDEEP 49152:joa1taC070UUBhKzzcjcHyZkwLBjFq0ZZY:joa1taC0VzY4HyZLBPZ
TLSH
T1FDB5F157F78196E5C69D0676AF508291523AF8326A0B4A4279CC131ECF53B878F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download