Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
- Size 373KB
- Sample260424-catd9sbt2p
- SHA256 00f2e48273b2b7e549fd749e67f398465a7bbe4b70d2ccb0447a56119f8030aa
- MD5 c05cd0d41581325ec03ab5d405f016cb
- SHA1 759edd7c024599e68f72322a1982fb578e19524f
- SHA512 89c2dbda395e1a6569a00b9c2cbe89c444eb6b9cbd8ea569c85665a3b24770891718cb0f056c1c476ef86552d850baa95af5bd66e8d85b35dd875016e644dcbc
- SSDEEP 6144:tXmRmdTpPX6ADu79SiirlTeeGyfgCA/j6FyAO/Hsumwc4+Qx+jeZAVl:sCTpiAvroeGyfgMy1Hs/wtx+je6Vl
- TLSH T1DC849D01729DB372E4F215325D7CFAA29DBD7D300D218AAF73D80A1DDE7268095297A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 2 IoCs
pid Process 3084 Logo1_.exe 1020 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\RCXF31A.tmp Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\RCXF3CB.tmp Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\RCXF4DA.tmp Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXFF71.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXF199.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\RCX296.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF3.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\RCX284.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXF39A.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE Logo1_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCXF1BB.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.Exe Logo1_.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Logo1_.exe 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe 3084 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1084 wrote to memory of 4704 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 84 PID 4704 wrote to memory of 5016 4704 net.exe 86 PID 1084 wrote to memory of 3016 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 87 PID 1084 wrote to memory of 3084 1084 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 88 PID 3084 wrote to memory of 3968 3084 Logo1_.exe 90 PID 3968 wrote to memory of 1708 3968 net.exe 92 PID 3084 wrote to memory of 2796 3084 Logo1_.exe 95 PID 2796 wrote to memory of 4044 2796 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:5016
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a625F.bat2⤵
- System Location Discovery: System Language Discovery
PID:3016
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1708
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4044
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1020
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXFF71.tmp
- Size 77KB
- SHA256 a2bc582bc299eb46619a07153960a33d987ba452af0dfa1d52351ac85b1729ad
- MD5 baca67b41da660cc50099ee9e90de906
- SHA1 df84808dd43c21da8d4151f27ac7478dc264f547
- SHA512 ce6f3dc3676bf462793a21b16e865b782501948bc1ff732e03ef06aa3cacad5f29f4cf9a751b992c84228bd001e7ba7ecaffb02f2506af342d2476716891cf17
- SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxN:TCSjGoLpWM6bblmjxN
- TLSH T19D73E656B18CB376D0E299BD8E0FF2E5BC253E201E1D589FB69A2F0DDE7A0C1550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX223.tmp
- Size 86KB
- SHA256 8805bc8ad9c89353af689fc4ca1b50ffb083b27499e784f2e2290a9ee91555b9
- MD5 ede5c977301d2bb502cd93dc6d4abaee
- SHA1 ce8ff3981dd3441dc5c405b101d5d8d3a5d77425
- SHA512 4af0e66e723fa131a46bc608e8860998647f0f3b0469e02ebf5710e10c0cfc9ff28bd640953597e3b1dc11f2a076eb89dbd9b12a3d48daf3c93b64f0a6b612e8
- SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS1XkSPsULMHir:zCSjGoLpWM6bblmjxSdtPlLqS
- TLSH T192834959B28DF772D0F299BC8E0CF2E5BC287D301F1A185BB69E1F0D9A765C2150C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXF3.tmp
- Size 101KB
- SHA256 3ce873fe622b3857a635479172a2f4b76099bc719ace4d81880be8457d77ddb5
- MD5 ae57bdf57419e7564ceddef6167696fe
- SHA1 43d2721dd7def84fa84a52b8269763536fbfb6b9
- SHA512 3e7832fc901e9994d3bbfdc25508c383173bcc21d5f564096181acc53f2baf219bdc5705aa29700c382cdc54439b4319c3555d7ef724edff4d7473e678fa6621
- SSDEEP 1536:C7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxh4GZjzQwK5WW7VCn6Kyi:7CSjGoLpWM6bblmjxPe5BV0f
- TLSH T1A8A37C65B68CF377C0E2A9B84E0CF1E5BD297E301E29185FB59A2F0DCA7B5C2550C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 638KB
- SHA256 dfa975e03a229421593b5fcdcf0a1dab56e5aff0b060678e1049777ea2eb0779
- MD5 5ad5785b3c42e9bbe377933e3b0eabe8
- SHA1 b50ebd9ee9ba970228404b5fc632dfee13bea9a4
- SHA512 0945a368a01524d0dd6f3e131f7157481853ac6b297fe609d06375e77fc602d9ee364b02a1ee83702e15e294fb38d5f5893511bdc18975340b57b9f24b4c6f28
- SSDEEP 12288:shXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:y0Le5ji0hmxNrM
- TLSH T1F5D4F715F66CB331D0F2C0B9C5DEB68AED713C411B3089CB5286876C6E676E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXEFCC.tmp
- Size 74KB
- SHA256 538ce1ae70d76432847796da3273f1d38fc176c670f54a013e15b25992921cf1
- MD5 aa4d45512fb78e95092f28bedb0075dd
- SHA1 6341962f424c1bf0fa25e93865073822794ecdab
- SHA512 958f6aecf6cf8c917539cba065e37a411949ba033df8bf8743336f4f27fa6d6dad712e7c7971744220e8c8d4e93f963abd9a94c19097f63950029b8d222710e4
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxO:DCSjGoLpWM6bblmjxO
- TLSH T1B6731A59B68DB372D0F299B89E0CF1E5BD283E301E19185FB6AE2F0DDA7B1C1150C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe.Exe
- Size 360KB
- SHA256 0823d413b0c1e0b0f1bbd64f83c67fa4525e2030f590581a16f57eb1657b3793
- MD5 cdeea0bca59509bbeb4ebd486dfeb5f3
- SHA1 da8256bf61f02d0898f0ae1ff30df575d4810c35
- SHA512 5fa4613d7f5f4bfb0731848808d7c4d19908ff335577eb175838be03cf25a489f12134014bf77b79156211518cb12d92d0a8c37ea91b3c6ec69a27350fc4e98c
- SSDEEP 6144:1XmRmMAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhI:0zCd9/WYoaLHF3z0z04PDvhI
- TLSH T189748C94B29C3BF4D8E385398D1DB556EEB27C250B20C65F23A8371A5F332911C2DB99
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe.Exe
- Size 4.2MB
- SHA256 e965665ae933349c2b1de0edd93e9958c262eabd3773bc703ceeb35b05583d6f
- MD5 356035c7a106302b9042bdaeda323b8e
- SHA1 97c67f4f5dacae9e62610cf4854178bae9833701
- SHA512 4645d624a897290f48d719ec7752472e77383b7fb32ebc2f1ddc1e47dab5ff3d109433f29e4439570e551a6931c75bd8e6840ea57e66f6faa9db35d7c16a3f18
- SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3TH/:bQvGAdlCEL8c/bRNw5CO
- TLSH T125263A656BEC91F5E0E7D134897A95B2FB7A7C020D32EB4B0151CA2F2F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\RCXF3AA.tmp
- Size 74KB
- SHA256 464194ec39b9900fa12b0c7ebdea7e75738a513961a02fe915c1ccf7e33c9dae
- MD5 e66e1731f881e7a26b7e99ac416c664f
- SHA1 9fc4f3289b54973104d459a80f98dc322fe38951
- SHA512 451c2a56dd1ebd40988ae284b67cb0edd97f6ae1037a40de37202457e31ccc67e88c1990358ab26cf4970110f316cb9d6d7bfc46b36c7f4ce2e322e5a6909c42
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx1:DCSjGoLpWM6bblmjx1
- TLSH T1FE730855B28CB776C0F299B8CE0DF2E5BC257E701E1918ABB6AE3F1DDA761C1050C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe.Exe
- Size 1.4MB
- SHA256 3bf97aa1d0925b582f5d0ce450bd275d90edc89a98030d642a71fc6a4dcf661b
- MD5 314c1747720640bf1544be4def1b7953
- SHA1 efd9c4502d234608c10dfdd667cb2432c4c37d2b
- SHA512 fcc0b9cbf889668bf44ee39410283ce6f5123da29e22005416ca40fa65588256a8bfe5948ad6ec80361ab203ec68fad9de9c9883e6c8788f4982a568d5e1ff8c
- SSDEEP 12288:UuUTTyUjD5xN9euP+bnEPKSjlSoRUJDJ095+B7a2SooEP2WKtsm45c:kTTHhmbEPKSjIov0BW1oZP21tT45c
- TLSH T120655B41B78CFB32D8EA493078BCF7262F35BD916E51C6B7331AB25C4E71351996820A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX8EF.tmp
- Size 75KB
- SHA256 2fdf7a4777c50bd2c92249ac7d39d415d0651840e8d4ce879dc2f57b21272451
- MD5 8234be4dd875ec740a88c22dfa0841bc
- SHA1 831ec4852b384b3e35449bc8034f11be2a8c3830
- SHA512 c0466b76727da87bc401329fd3deacd7e379be9d46240e488c4b9e291ab98b70c45593613f59b8e60e75f04566396bfa8551a4617a7681b724f46ef4f0328edd
- SSDEEP 1536:W7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxHO:HCSjGoLpWM6bblmjxHO
- TLSH T129732965F28CB776C0F299B88E0DF1E5BC287E305E29189B769E2F0DDA7B1C2550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a625F.bat
- Size 1022B
- SHA256 fc2d55d2cad9aa584bc2cf65ee2994c5363d1318a6172fd62a8de00ac55e1133
- MD5 95c5245f719b72a94dce19e43f2cdf82
- SHA1 d85599d0419ecf1ce7a27edcd62e49e4f06f0cbc
- SHA512 e9314eeda7751f147f84539c5fc296c0aee92a8238bfb903c5457bf36fe21028b5f138acf3f63560e11a8b0dc6c7ef4e968410c7e850e084d94b4d558ad0e22d
- TLSH T11311E907827FEFDB0591E00B9BB05E8B81253A5A370B33221358C65E54D284EF1E774B
- MD5 SHA1 SHA512 TLSH
2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
- Size 284KB
- SHA256 4dfadea4c0f21edeea184d18a3e18fda76ba032a9e36a5c787260195f6ab85b1
- MD5 a4dcdd8c0e0f54d180328b4c4232a30c
- SHA1 27153058e4627a3ee739435a5d7b78acd559ae84
- SHA512 73e7e78a747c4c1637f9c4f2839373ea15978d9711232cdcf03224aa5fd5401fc02eeaab09efbe131f42b530bd5277b5d0bc46a1ff38a9f7d61b42129172fd6a
- SSDEEP 6144:8TpPX6ADu79SiirlTeeGyfgCA/j6FyAO/Hsumwc4+Qx+jeZAVl:8TpiAvroeGyfgMy1Hs/wtx+je6Vl
- TLSH T19154AE0276E18072E9B215325978EA629AFD7D300931CABF23D44E1DDF71680D53ABB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 89KB
- SHA256 b89b79d5cbe998285bcc254020c647412a09f379bd8d637e59e862ec225e67aa
- MD5 4c2ebcd2127e329ebe52bfee6dec8470
- SHA1 dc1300faabc15fcaa095040ea4b6764a5a179e81
- SHA512 28cf02725dcaa2f0b1436f2e104247d74f11d9889755006e46726f5fa449debd94dbaeea387ffb7736839ecd6bef4656e79d43f062e30437e178865e93ecbc2e
- SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxxE5Rr:3CSjGoLpWM6bblmjxE
- TLSH T102934B65B18CF772D0F259B89E0CF2E1BC797E301E19189BB69D2F0DDA760C2191C296
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH