30b27dff590f334180ada41465b529483a30d033fa5514f522b3fe61f8715b5e

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/09/2026, 19:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe
Size 2.3MB
Sample260907-xxdbsaah32
SHA256 30b27dff590f334180ada41465b529483a30d033fa5514f522b3fe61f8715b5e
MD5 692dd23df05945dba99fc5a86aaf54d0
SHA1 591a4e05e2479ff1f0ee456330fbd03338719d5f
SHA512 f38244dc14266fcba42cedbfa07bf6e56f95ce92e2ac5440cd78bb44b2216cab349513cf00e2c8c442afca5761461cfc78aa7b3355ef0de4943308265c8a9076
SSDEEP 49152:joa1taC070UxmmX6W2f6lWErCRMlU1BjbMD35IS:joa1taC0fmmKWzuRMlU1B09
TLSH
T1EBB5F153FB9086E5C65D45369B608291963AF8326A0B5B42798C131DCF53BCB8F22F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3636	82C3.tmp

Executes dropped EXE 1 IoCs

pid	Process
3636	82C3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82C3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 3636	5956	2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Users\Admin\AppData\Local\Temp\82C3.tmp
  "C:\Users\Admin\AppData\Local\Temp\82C3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-09-05_692dd23df05945dba99fc5a86aaf54d0_amadey_elex_njrat_smoke-loader.exe 41710802CC025680A296FAA646E86090E33082510D1C8AFA7174474BB96F7E206C5A19DFBA700AB47EA607C03838CA1E055B02834010DABCFF989831702AF633
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

82C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\82C3.tmp
Size 2.3MB
SHA256 954489e494ef478b49cc0cc5b09e43cefd119650e53bdfca5296351bddde0902
MD5 16c363b9b98cbc5c6e301d093de507d6
SHA1 9ad7c2bb91645d7c8440698cc424dbae8419699e
SHA512 e1255117328451fd3202860a09dd60c323226022b7d14e5f2209ca774739c249eee986c5be939e696d75d321915161824b0362cb983cce7444642561ca3620d8
SSDEEP 49152:joa1taC070UX+6Mwrs7s0lzTl4kDEe0OxogZu:joa1taC0tMywaDv4
TLSH
T194B5F117FB9196E5C25D49729B608291923AF432AA0B574279CC130DCF53B8B8F62F3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download