353efcbe7879d44e3d40431ff9797a83d432793beac27fb49a3e0a977a336dbd

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe
Size 2.1MB
Sample261024-b5dfvsg16k
SHA256 353efcbe7879d44e3d40431ff9797a83d432793beac27fb49a3e0a977a336dbd
MD5 a6fe089933d95c0466f17d3439f8bb94
SHA1 28caddbd3c640cd93232ca3ac3ef4625ef920156
SHA512 c36bf94efa3e03297d0ab61a2956a9a6751b8cb5d2f391a4f39931e24bbbb413360ead0bcd4c4e008a9a318455c43b487fba365e0ba4883550c56d4920d82378
SSDEEP 49152:Roa1taC070UyVcG82yLu700E4vnaPsdvOJFIg:Roa1taC0/GDF00/SJ
TLSH
T1D9A50205B718B0F3C5505FB0A8A58BD7A6216CBB7B419DC729C4535E0C9BAC8AF13F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3416	4472.tmp

Executes dropped EXE 1 IoCs

pid	Process
3416	4472.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4472.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 3416	3620	2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\4472.tmp
  "C:\Users\Admin\AppData\Local\Temp\4472.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-10-22_a6fe089933d95c0466f17d3439f8bb94_amadey_elex_njrat_smoke-loader.exe 87119E6897DFB109275E1871A0F583787564272325743B7CC668BC85E4CA7C5B67C43DB124C50E8B5732F02782FF86F0EEFA1442772CCF2EFFA36FF79854B034
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4472.tmp

Path C:\Users\Admin\AppData\Local\Temp\4472.tmp
Size 2.1MB
SHA256 f6682f9deba9b63f307167c4031564f2a8fa4c6e36d3c5a99b0b36c75ee256a6
MD5 6481e9fd00045a21b8aaa4689e58bf96
SHA1 d8e50c3e1167be9f669bd209d09ab368f228d4d8
SHA512 309f4b19480037c13cdfd08d4fa5bb574116436a94a0e74c7a4dc0a6a41e8595c44a5655ec6e00611ac62bf521aeec144c4c58bfb539fddc4166216d589c665f
SSDEEP 49152:Roa1taC070U26EXIpgs6HVaEGsVvZ5/6GZytz3TCxyWuacN2cdvOJFIg:Roa1taC0nEXKg3FrfStz3TCmc
TLSH
T16DA50104B714B0F3C5215FB0A865DB92A6217CBB7B01ADC769C8135E4C9ABC89F53F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download