19b651e0690bd4acb6837d8472af8b8e4c17c84a495f2e47c023cf247e1d7ad5

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c25f95a026e02403fc7358d40eb51c7b_amadey_elex_njrat_smoke-loader.exe
Size 2.1MB
Sample261102-3jaavsxwcs
SHA256 19b651e0690bd4acb6837d8472af8b8e4c17c84a495f2e47c023cf247e1d7ad5
MD5 c25f95a026e02403fc7358d40eb51c7b
SHA1 bd28bc19e0ce6982ff5a51a0c10d7ff198aade3c
SHA512 4239616aff19051593e9c7746189d33e387a9bfa39434930520e3f107419d4de967761bb124790a2e16e6757a98a309f10188b9868714a2d6f0f4f5f2e7e5325
SSDEEP 49152:Roa1taC070UrpI0wKCgROBxRwqnX55hnDcePuzyhsGdvOJFIg:Roa1taC0FpINnBxRw4XhnDcBWs
TLSH
T120A50115B714B0F3C6225BB068958B93A6216CB77B419DC729C4635F0CDBAC89F23F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1660	5B84.tmp

Executes dropped EXE 1 IoCs

pid	Process
1660	5B84.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5B84.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_c25f95a026e02403fc7358d40eb51c7b_amadey_elex_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5504 wrote to memory of 1660	5504	2026-11-02_c25f95a026e02403fc7358d40eb51c7b_amadey_elex_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c25f95a026e02403fc7358d40eb51c7b_amadey_elex_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c25f95a026e02403fc7358d40eb51c7b_amadey_elex_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Users\Admin\AppData\Local\Temp\5B84.tmp
  "C:\Users\Admin\AppData\Local\Temp\5B84.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-11-02_c25f95a026e02403fc7358d40eb51c7b_amadey_elex_njrat_smoke-loader.exe 04E6A44F50397DE9E0B610C00934D4D01DF7EE51DF9B2FDFD9BCAB5E479651E7705564C00F06B2D9C2000855B8A63DBC50D5C4FA6157174FC8A8124D23128BDA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5B84.tmp

Path C:\Users\Admin\AppData\Local\Temp\5B84.tmp
Size 2.1MB
SHA256 a555d4b645d67ad6646cc09ec78eca5babfa201a2bc5fc286bb4c59fe2a8c1d0
MD5 1ddfe436b13020236efdca16d565d335
SHA1 be1b630e448ca3389ce6ce7340f85cd4c8d13c32
SHA512 3e6434e716ea52d9113a8ea6bc3d1bb45594b72a0293581285a58af25fc97f97b5158d7e5424257d96bf6f1e50bfb4b5a79617dc7720bfd4562a582a8e1df6fa
SSDEEP 49152:Roa1taC070UUX2C/0yVn/BhRs3GJRtRWGdvOJFIg:Roa1taC0O/0yV/fRs3GDtgr
TLSH
T10BA50205B718B0F3C6615B70A8559B93A6216C7B7B419DC729C4234F0C9BBC8AF27F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download