5caab0b79e18fd31a9c945539aa2d28b67fec344a09aba8a98e787ecb4a809e9

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_53ef7b76247d658861d3abea45159efe_amadey_elex_njrat_smoke-loader.exe
Size 2.1MB
Sample261002-ryx5patzcs
SHA256 5caab0b79e18fd31a9c945539aa2d28b67fec344a09aba8a98e787ecb4a809e9
MD5 53ef7b76247d658861d3abea45159efe
SHA1 f160d7354e819aaf313bc1d5473486f1bf053314
SHA512 835504918f9c12f3f180c7c5418a6689cde379d507fcab5abad9d43c05f6f875239f964d635e0d08bd4135dc75872dfad1b691bf21c1025deb4565fb59413d0d
SSDEEP 49152:Roa1taC070UVGqTviG1e9U5C+PiPArOmt8NdvOJFIg:Roa1taC0Kq7ZWiC+HiW
TLSH
T1EEA50201B754B0F3C5215B70A46987D3A6216CBB7B01ADC769C4135F5CABAC8AF23F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1252	285E.tmp

Executes dropped EXE 1 IoCs

pid	Process
1252	285E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_53ef7b76247d658861d3abea45159efe_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	285E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 1252	1740	2026-10-01_53ef7b76247d658861d3abea45159efe_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-01_53ef7b76247d658861d3abea45159efe_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_53ef7b76247d658861d3abea45159efe_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\285E.tmp
  "C:\Users\Admin\AppData\Local\Temp\285E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-01_53ef7b76247d658861d3abea45159efe_amadey_elex_njrat_smoke-loader.exe 6FDC9A33635089B53684D9B7C148B9875DBF413986FA0C32B54AB093BC91D1EE1ED31AB01C1C469B81F1185AAB00436406D1174B422C029FC74A5A9EC962233C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

285E.tmp

Path C:\Users\Admin\AppData\Local\Temp\285E.tmp
Size 2.1MB
SHA256 07122053ae413af5c286aa85c9e180b03f2a765bb6b41500a6f1346dde7810ee
MD5 5307bcb97d4de90bcca36553d64f06c1
SHA1 9d1f9a7c82f235ef8ce87d8e50b33b79eb59e3c1
SHA512 0604e78efe52644ffd5b56aacbc3607f62800bcef74eefecc2ddb3bd434792c9e9315ea6bb4151547ec4a143de9be91bce86e6f84a1ed1e57218dd54f9a2da2c
SSDEEP 49152:Roa1taC070UN2c8ETj5v7ZSVP3dOaZOklOdvOJFIg:Roa1taC0f2c8uFVUQWOkN
TLSH
T192A50105B714B0F3C621AB70A9559B93966178BB7B009DC729C4535F0CDBBC8AF22F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download