2e2d5e6b1bf9efe879eac8b0e869e78383a1657be0d800d7720436d250fcc957

General

Target
2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Size 635KB
Sample260423-e3dwdsax8y
SHA256 2e2d5e6b1bf9efe879eac8b0e869e78383a1657be0d800d7720436d250fcc957
MD5 322aa6d0bf8745098e54d2744e7dc767
SHA1 9f91edef7b2eaa964993bae388647739453d5018
SHA512 669ddddc1df2ce136438ae9e8a0a37efed4f100e24137032afdeec8a734adfc64216accddb5894aaee15476a191905f2fc131bd0c65e87d01211d8eada928395
SSDEEP 12288:6kc3MbnmNpWAXCe/FH0H/WuJKC0gJmxZ7FXrPy4ix+LBltsgK7zXIqbkk:6wbmTzyewXJWZ7V+4s+PtY/XIq3
TLSH
T170D4B012F2D2C073D4B7053006AA9B369EBEBE20073589D757D40E5DAE712D2EA3A717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.sendgrid.net
Port
587
Username
apikey
Password
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

Signatures

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/3104-0-0x00000000000B0000-0x0000000000156000-memory.dmp	Nirsoft
behavioral1/files/0x00090000000241c7-5.dat	Nirsoft

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/3104-0-0x00000000000B0000-0x0000000000156000-memory.dmp	WebBrowserPassView
behavioral1/files/0x00090000000241c7-5.dat	WebBrowserPassView

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Executes dropped EXE 2 IoCs

pid	Process
2328	App.exe
552	App.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	icanhazip.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2328	App.exe
2328	App.exe
552	App.exe
552	App.exe
552	App.exe
552	App.exe
2328	App.exe
2328	App.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3104	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 2328	3104	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	88
PID 3104 wrote to memory of 552	3104	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Users\Admin\AppData\Roaming\Explorer\App.exe
  "C:\Users\Admin\AppData\Roaming\Explorer\App.exe" -B /stext C:\Users\Admin\AppData\Roaming/Explorer/Output.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Users\Admin\AppData\Roaming\Explorer\App.exe
  "C:\Users\Admin\AppData\Roaming\Explorer\App.exe" -B /stext C:\Users\Admin\AppData\Roaming/Explorer/Output.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

App.exe

Path C:\Users\Admin\AppData\Roaming\Explorer\App.exe
Size 391KB
SHA256 f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
MD5 053778713819beab3df309df472787cd
SHA1 99c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA512 35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
SSDEEP 6144:wE+Z7EAXrvPRIxK0zBL/TIDC2dL3RltnfoBglM7zMUdsvk3zhAt76zkizX5:QZ7FXrPy4ix+LBltsgK7zXIqbkk5
TLSH
T1E084AE03F3D28076E8A70570066B5B36DEFABE201635895757D41C89BEB16D2EA3E307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Output.txt

Path C:\Users\Admin\AppData\Roaming\Explorer\Output.txt
Size 4KB
SHA256 9ef99983752a54c7f699f181d52e21509cd961622e7f835a3ca680fabb530af2
MD5 97cc7ce73d6f07afb0f07c867a615932
SHA1 ec37e320a66e036742d8aefca4b29f34c78ba335
SHA512 23d3b6b7ff165a62f94565afb951911670f5d65a104c4dd9418f45e30890bb8b0e066cd5ad4b739e44e6837fa288437b4f007610a0353e2344886716dc197328
SSDEEP 48:wvvv0bxfvvcbxfdvv0bxBvv0bxakvv0b7:mv2xv+p1v2Pv2bv27
TLSH
T182914A4716E90408F0B6BA46D97B15B65B7338199CBC815C60DCA3D80BF3910EAE37D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3104-0-0x00000000000B0000-0x0000000000156000-memory.dmp

Download

memory/3104-26-0x0000000004B00000-0x0000000004B10000-memory.dmp