Analysis
- max time kernel
150s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe
- Size 751KB
- Sample260415-2ynlcsdy7y
- SHA256 c13a4172d654089cd361fd92cb6f3695ab28a6c1d418e3c7a80131af83a75585
- MD5 1c827e039cd77e42d29b24b9bca842d3
- SHA1 cf1f3143de4adaf51a674e7d4f8cde906022351b
- SHA512 2680d4bd46dfee2a1fdb0af438d2d6b79f3ff86c8ad8ea3c8314f8ded52c9b69520577f287d6c9a12005a8822112908067b2bedc3d5426114f38c40c2e078b43
- SSDEEP 12288:3lG8lBe5mWukhI2jFMSjysAS9X/GsfTDYrGigYLBrhoMZv9GYOXd56hDnmgO:3lGN5mWpI2jFM5sFzfTpiTLbo8NON56u
- TLSH T15DF49E32A5614036E7F101B3B928D5307D7CE328175089AAE3D4EE1D3E748D26BBB657
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4628 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho 3352 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho - Loads dropped DLL 1 IoCs
pid Process 3352 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Shohdi.hdi 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\Shohdi.hdi 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files\7-Zip\7zG.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.sho 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4296 3352 WerFault.exe 81 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2728 wrote to memory of 4628 2728 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe 80 PID 4628 wrote to memory of 3352 4628 2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.shoC:\Users\Admin\AppData\Local\Temp\2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\Temp\{2D7EDE87-DCC8-46E5-AD16-71C5A19897C1}\.cr\2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho"C:\Windows\Temp\{2D7EDE87-DCC8-46E5-AD16-71C5A19897C1}\.cr\2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho" -burn.filehandle.attached=724 -burn.filehandle.self=7283⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 9724⤵
- Program crash
PID:4296
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3352 -ip 33521⤵PID:3864
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_1c827e039cd77e42d29b24b9bca842d3_amadey_coinminer_elex_luca-stealer_njrat_nymaim_remcos_rhadamanthys_smoke-loader.sho
- Size 609KB
- SHA256 8b40916cf97c2c9f7c1fa17495a6b76c8676b164a02054e2dfec8967ade7f925
- MD5 89fb5575140913fc9fed60c45f8f70bc
- SHA1 acf08936220ad26b61f77691787712ec7aaee364
- SHA512 e696daee32620c1168236b8ff3cfa94a9181fa75385d4da8064a6ff6cafb522398d6003a36e2acd55b0625ffa9f7646bf29abfbf0a0dd872bfb757f63651a30a
- SSDEEP 12288:U5mWukhI2jFMSjysAS9X/GsfTDYrGigYLBrhoMZv9GYOXd56hDnmgG:U5mWpI2jFM5sFzfTpiTLbo8NON56hlG
- TLSH T1D7D48E32A5614036F7F106B3B928D1303E7CE328175089AAE7D4AD1D3EB489667FB257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Shohdi.hdi
- Size 751KB
- SHA256 9054cde7071d904174317e36465767938927bf1b55474196d9d5ea5a1456554e
- MD5 0cb24be7eaf166a496e9f9456c39baa1
- SHA1 e086f099f29cb373a53598c2282f97924cb1e20b
- SHA512 59728e7d00998975d6cc7ee0d96763dcf6654aab4aea8d164aa138d96a214413fc99fe353320229b2adc93032793fba666993e6c88eb55b16fe7e9585ba00dfb
- SSDEEP 12288:pG8lBe5mWukhI2jFMSjysAS9X/GsfTDYrGigYLBrhoMZv9GYOXd56hDnmgO:pGN5mWpI2jFM5sFzfTpiTLbo8NON56hg
- TLSH T115F49E32B5614036E6F202B3B928D5307E7CE328175089AAD3D4ED5D3E748D26BBB653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A4A448C7-FCEB-4C6A-A355-AB6217E97F0B}\.ba\bg.png
- Size 4KB
- SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
- MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
- SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
- SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d
- SSDEEP 48:u+Xg+NXWbdlIr33lx9W5OstaDIy3r5XpPyvZKmXYTDeiByNxcaaaaaaaaaaaaaaE:AaXWPIrHT932JsdpPyjqDeioatEn
- TLSH T19891B4D8FCF95322C6002BF255F4C0735A0215B713ABFEC82F496BD90E6878E25058B2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{A4A448C7-FCEB-4C6A-A355-AB6217E97F0B}\.ba\wixstdba.dll
- Size 197KB
- SHA256 41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
- MD5 4356ee50f0b1a878e270614780ddf095
- SHA1 b5c0915f023b2e4ed3e122322abc40c4437909af
- SHA512 b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691
- SSDEEP 3072:4Fj2AYmaHqco56wsPZozShZTjVORuXzv7x5Okw7QWwF4QUdPArtOuw6meOlONtZz:4Fj2ARaKaPZ3TjcAR5OflbQ7tOzKh40V
- TLSH T1A2149F11B6D0A076EBFB16307A75A5216E7DB6200FA0C9DF63489C2B1DB05C19B36B37
- MD5 SHA1 SHA512 SSDEEP TLSH