2e2d5e6b1bf9efe879eac8b0e869e78383a1657be0d800d7720436d250fcc957

General

Target
2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Size 635KB
Sample260423-e3dwdsax8y
SHA256 2e2d5e6b1bf9efe879eac8b0e869e78383a1657be0d800d7720436d250fcc957
MD5 322aa6d0bf8745098e54d2744e7dc767
SHA1 9f91edef7b2eaa964993bae388647739453d5018
SHA512 669ddddc1df2ce136438ae9e8a0a37efed4f100e24137032afdeec8a734adfc64216accddb5894aaee15476a191905f2fc131bd0c65e87d01211d8eada928395
SSDEEP 12288:6kc3MbnmNpWAXCe/FH0H/WuJKC0gJmxZ7FXrPy4ix+LBltsgK7zXIqbkk:6wbmTzyewXJWZ7V+4s+PtY/XIq3
TLSH
T170D4B012F2D2C073D4B7053006AA9B369EBEBE20073589D757D40E5DAE712D2EA3A717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery spyware stealer

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.sendgrid.net
Port
587
Username
apikey
Password
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

Signatures

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1448-0-0x0000000000490000-0x0000000000536000-memory.dmp	Nirsoft
behavioral2/files/0x001a00000002b406-5.dat	Nirsoft

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1448-0-0x0000000000490000-0x0000000000536000-memory.dmp	WebBrowserPassView
behavioral2/files/0x001a00000002b406-5.dat	WebBrowserPassView

Executes dropped EXE 2 IoCs

pid	Process
1844	App.exe
4804	App.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	icanhazip.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1844	App.exe
1844	App.exe
4804	App.exe
4804	App.exe
1844	App.exe
4804	App.exe
1844	App.exe
4804	App.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1844	1448	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	81
PID 1448 wrote to memory of 4804	1448	2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_322aa6d0bf8745098e54d2744e7dc767_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Roaming\Explorer\App.exe
  "C:\Users\Admin\AppData\Roaming\Explorer\App.exe" -B /stext C:\Users\Admin\AppData\Roaming/Explorer/Output.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1844
- C:\Users\Admin\AppData\Roaming\Explorer\App.exe
  "C:\Users\Admin\AppData\Roaming\Explorer\App.exe" -B /stext C:\Users\Admin\AppData\Roaming/Explorer/Output.txt
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

App.exe

Path C:\Users\Admin\AppData\Roaming\Explorer\App.exe
Size 391KB
SHA256 f999357a17e672e87fbed66d14ba2bebd6fb04e058a1aae0f0fdc49a797f58fe
MD5 053778713819beab3df309df472787cd
SHA1 99c7b5827df89b4fafc2b565abed97c58a3c65b8
SHA512 35a00001c718e36e956f49879e453f18f5d6c66bbc6a3e1aad6d5dd1109904539b173c3cad0009bc021d4513a67ae0003282f7d14b7aecaa20e59a22c6ad0ddb
SSDEEP 6144:wE+Z7EAXrvPRIxK0zBL/TIDC2dL3RltnfoBglM7zMUdsvk3zhAt76zkizX5:QZ7FXrPy4ix+LBltsgK7zXIqbkk5
TLSH
T1E084AE03F3D28076E8A70570066B5B36DEFABE201635895757D41C89BEB16D2EA3E307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Output.txt

Path C:\Users\Admin\AppData\Roaming\Explorer\Output.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/1448-0-0x0000000000490000-0x0000000000536000-memory.dmp

Download

memory/1448-30-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

memory/1448-31-0x0000000004E50000-0x0000000004E60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads