353efcbe7879d44e3d40431ff9797a83d432793beac27fb49a3e0a977a336dbd

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe
Size 2.1MB
Sample261024-b5dfvsg16k
SHA256 353efcbe7879d44e3d40431ff9797a83d432793beac27fb49a3e0a977a336dbd
MD5 a6fe089933d95c0466f17d3439f8bb94
SHA1 28caddbd3c640cd93232ca3ac3ef4625ef920156
SHA512 c36bf94efa3e03297d0ab61a2956a9a6751b8cb5d2f391a4f39931e24bbbb413360ead0bcd4c4e008a9a318455c43b487fba365e0ba4883550c56d4920d82378
SSDEEP 49152:Roa1taC070UyVcG82yLu700E4vnaPsdvOJFIg:Roa1taC0/GDF00/SJ
TLSH
T1D9A50205B718B0F3C5505FB0A8A58BD7A6216CBB7B419DC729C4535E0C9BAC8AF13F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
448	CA8E.tmp

Executes dropped EXE 1 IoCs

pid	Process
448	CA8E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CA8E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 448	1028	2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\CA8E.tmp
  "C:\Users\Admin\AppData\Local\Temp\CA8E.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe C75206BBEFC4096220DE521740A2DB86F696A6B71688C40D7EF4BFEF53078418FBD16F241034CD5B4941E2F949D252FD63E4EDE1477DCE70D2A977DD199E453C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CA8E.tmp

Path C:\Users\Admin\AppData\Local\Temp\CA8E.tmp
Size 2.1MB
SHA256 9fc8f84eddd0bbf91be630ad71c020140e02fdac4ed8d0ebfb32b2d91894601f
MD5 d9c62e2fd22659bbf71773e1807ff472
SHA1 6427be0692dbe69f8756e787be3e1b692f1f50e2
SHA512 8d2169e56b48f7691e39df6b1d38fc73c1f1b5986b42aaf6e571a31b5a449132edba7b6f47b99fa921e7ca40b1b36b8c218a1f3938653c6599d28a240dadca46
SSDEEP 49152:Roa1taC070Uph4kj/gkIsySHwPt3KbK3cwuKdvOJFIg:Roa1taC0Pykj/gXkHstXsJX
TLSH
T10BA50105B714B0F3C6255BB0A855D7A3A6216C7BBB41ADC369C4634E4CDABC89F13F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download