a6f06336da8b130bedc24fbdc78b649e1bf6d8608fe66e855fad7e83f67f11c0

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_98d7152e03625cd1ecf098f6561c70b3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Size 129KB
Sample260421-ev9yvsbv7x
SHA256 a6f06336da8b130bedc24fbdc78b649e1bf6d8608fe66e855fad7e83f67f11c0
MD5 98d7152e03625cd1ecf098f6561c70b3
SHA1 682fbb3a182b54592b1094f06b31d15e093a0332
SHA512 7efdd43cbc1891e88104cec8d38008149b5b657124abfa851920c805a16c7c9d2ad59c47f6b79b13c8edaa9f9ac97f22326db753838bc3815fccb96e7d07474d
SSDEEP 3072:451dkqeI3cJyNS1i+5FZt+gaPHfYemZ9E/vhT0M3RFiH:4micJiS1zTDdMLmWKaFiH
TLSH
T111D3AE06B8C1C072D5763A311534DBB1AE7EF8300F54AE5B7798067A5F306C18A7AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAX5-00401C608512}	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAX5-00401C608512}\StubPath = "C:\\RECYCLER\\S-1-6-21-2434476501-1644491937-600003330-1213\\system.exe"	system.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Active Setup\Installed Components	system.exe

Executes dropped EXE 1 IoCs

pid	Process
1032	system.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini	2026-04-21_98d7152e03625cd1ecf098f6561c70b3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini	system.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_98d7152e03625cd1ecf098f6561c70b3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1032	8	2026-04-21_98d7152e03625cd1ecf098f6561c70b3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-21_98d7152e03625cd1ecf098f6561c70b3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_98d7152e03625cd1ecf098f6561c70b3_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8
- C:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\system.exe
  "C:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\system.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Desktop.ini

Path C:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\Desktop.ini
Size 63B
SHA256 a21515b30a0f7757d85f4f0d8c46c2c49269ffd37751209adad6a3e335815635
MD5 f15d08ecd83971825fceb970d7f7b830
SHA1 32a22f2ea5aab57d83f394574cd98f379d138122
SHA512 e5ff601ba7ab1dd1191242962909e139ca4f41daf9a45b45fad4e646108b176976ced560156f3f1861cc394ed90f246104a8e3be07880e2f44e7b3c49f18832a
TLSH
T19BA00229DF08C554E945757690198839E4ADB01C0670D11006E870A5D8216598B74DB5
MD5 SHA1 SHA512 TLSH

Submit Download

system.exe

Path C:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213\system.exe
Size 129KB
SHA256 a6f06336da8b130bedc24fbdc78b649e1bf6d8608fe66e855fad7e83f67f11c0
MD5 98d7152e03625cd1ecf098f6561c70b3
SHA1 682fbb3a182b54592b1094f06b31d15e093a0332
SHA512 7efdd43cbc1891e88104cec8d38008149b5b657124abfa851920c805a16c7c9d2ad59c47f6b79b13c8edaa9f9ac97f22326db753838bc3815fccb96e7d07474d
SSDEEP 3072:451dkqeI3cJyNS1i+5FZt+gaPHfYemZ9E/vhT0M3RFiH:4micJiS1zTDdMLmWKaFiH
TLSH
T111D3AE06B8C1C072D5763A311534DBB1AE7EF8300F54AE5B7798067A5F306C18A7AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads