Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Resource
win11-20260130-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
- Size 373KB
- Sample260424-catd9sbt2p
- SHA256 00f2e48273b2b7e549fd749e67f398465a7bbe4b70d2ccb0447a56119f8030aa
- MD5 c05cd0d41581325ec03ab5d405f016cb
- SHA1 759edd7c024599e68f72322a1982fb578e19524f
- SHA512 89c2dbda395e1a6569a00b9c2cbe89c444eb6b9cbd8ea569c85665a3b24770891718cb0f056c1c476ef86552d850baa95af5bd66e8d85b35dd875016e644dcbc
- SSDEEP 6144:tXmRmdTpPX6ADu79SiirlTeeGyfgCA/j6FyAO/Hsumwc4+Qx+jeZAVl:sCTpiAvroeGyfgMy1Hs/wtx+je6Vl
- TLSH T1DC849D01729DB372E4F215325D7CFAA29DBD7D300D218AAF73D80A1DDE7268095297A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (258) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe - Executes dropped EXE 2 IoCs
pid Process 1708 Logo1_.exe 4348 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Music.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCXEC20.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\JoinUpdate.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe.Exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe.Exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe.Exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXF91D.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe Logo1_.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Logo1_.exe 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\uninstall\rundl132.exe Logo1_.exe - System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe 1708 Logo1_.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1020 wrote to memory of 2136 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 80 PID 2136 wrote to memory of 4708 2136 net.exe 82 PID 1020 wrote to memory of 3656 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 83 PID 1020 wrote to memory of 1708 1020 2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe 84 PID 1708 wrote to memory of 3540 1708 Logo1_.exe 86 PID 3540 wrote to memory of 4076 3540 net.exe 88 PID 1708 wrote to memory of 3128 1708 Logo1_.exe 91 PID 3128 wrote to memory of 3192 3128 net.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:4708
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CB1.bat2⤵
- System Location Discovery: System Language Discovery
PID:3656
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:4076
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:3192
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4348
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RCXF696.tmp
- Size 139KB
- SHA256 a144b05de8c969bc2ce9451982841794bb8ec0c69bdf2a674e926a87d7393947
- MD5 b4c1277e6063af3d2b86b166191f22d9
- SHA1 61beebdf66cae30879075874009e3fb74f8b9141
- SHA512 9b0dd98d924e3547766f3361135c230e2b7fdf7738fe790a255a2e949fa3a10413c5531969870fbec5049b1a9063da8d9ba83ccf94f6f370ef1b7464cd01a28d
- SSDEEP 1536:v7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx/:+CSjGoLpWM6bblmjx/
- TLSH T1FCD36E6DB14FB3F2D3E198BC8D1CF295ED28FE20DE19285A75993B0E9A7A0C34508195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCXF8DB.tmp
- Size 77KB
- SHA256 a2bc582bc299eb46619a07153960a33d987ba452af0dfa1d52351ac85b1729ad
- MD5 baca67b41da660cc50099ee9e90de906
- SHA1 df84808dd43c21da8d4151f27ac7478dc264f547
- SHA512 ce6f3dc3676bf462793a21b16e865b782501948bc1ff732e03ef06aa3cacad5f29f4cf9a751b992c84228bd001e7ba7ecaffb02f2506af342d2476716891cf17
- SSDEEP 1536:a7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxN:TCSjGoLpWM6bblmjxN
- TLSH T19D73E656B18CB376D0E299BD8E0FF2E5BC253E201E1D589FB69A2F0DDE7A0C1550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXFAAD.tmp
- Size 86KB
- SHA256 8805bc8ad9c89353af689fc4ca1b50ffb083b27499e784f2e2290a9ee91555b9
- MD5 ede5c977301d2bb502cd93dc6d4abaee
- SHA1 ce8ff3981dd3441dc5c405b101d5d8d3a5d77425
- SHA512 4af0e66e723fa131a46bc608e8860998647f0f3b0469e02ebf5710e10c0cfc9ff28bd640953597e3b1dc11f2a076eb89dbd9b12a3d48daf3c93b64f0a6b612e8
- SSDEEP 1536:67qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxS1XkSPsULMHir:zCSjGoLpWM6bblmjxSdtPlLqS
- TLSH T192834959B28DF772D0F299BC8E0CF2E5BC287D301F1A185BB69E1F0D9A765C2150C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXFA2D.tmp
- Size 101KB
- SHA256 3ce873fe622b3857a635479172a2f4b76099bc719ace4d81880be8457d77ddb5
- MD5 ae57bdf57419e7564ceddef6167696fe
- SHA1 43d2721dd7def84fa84a52b8269763536fbfb6b9
- SHA512 3e7832fc901e9994d3bbfdc25508c383173bcc21d5f564096181acc53f2baf219bdc5705aa29700c382cdc54439b4319c3555d7ef724edff4d7473e678fa6621
- SSDEEP 1536:C7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxh4GZjzQwK5WW7VCn6Kyi:7CSjGoLpWM6bblmjxPe5BV0f
- TLSH T1A8A37C65B68CF377C0E2A9B84E0CF1E5BD297E301E29185FB59A2F0DCA7B5C2550C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCXEA3E.tmp
- Size 74KB
- SHA256 538ce1ae70d76432847796da3273f1d38fc176c670f54a013e15b25992921cf1
- MD5 aa4d45512fb78e95092f28bedb0075dd
- SHA1 6341962f424c1bf0fa25e93865073822794ecdab
- SHA512 958f6aecf6cf8c917539cba065e37a411949ba033df8bf8743336f4f27fa6d6dad712e7c7971744220e8c8d4e93f963abd9a94c19097f63950029b8d222710e4
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxO:DCSjGoLpWM6bblmjxO
- TLSH T1B6731A59B68DB372D0F299B89E0CF1E5BD283E301E19185FB6AE2F0DDA7B1C1150C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCXEB4E.tmp
- Size 75KB
- SHA256 f6f5bc585fd4fa05e86108d155ebe70ad0fa0eb4566885b8c211c633be614d96
- MD5 9ec8ce442cd3a8ee15490ee8ca31645f
- SHA1 523b92914b85198a0ece77a05d46c75b57c39507
- SHA512 ed0a69bfa24b93bfc96ab3b02ac7b089e9fd6dc9bf923aaf80b9710f7ff4aea7dc61307df5526cfb1db890be16f7edac8d7285b3fc92ba8205f43137c0a36b1c
- SSDEEP 1536:O7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxu:fCSjGoLpWM6bblmjxu
- TLSH T1C3731965B28CB376C0F299B89E0DF2E5BC257E301E19185BB5AE3F0DDA7B1C2550C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\RCXEE02.tmp
- Size 74KB
- SHA256 410a4d7848292a6db63c8167e5cc471de0c7a5b9514416d4a592c5e125939d0d
- MD5 60bc746b009ef5a4dcf644201e4d5dde
- SHA1 cd89636bde20918d02255ff42d4d1afee18dc4b9
- SHA512 fdfb7eb49975a8c63072ba8beee179bc253b0802127eac98602980557e7378d2c3f5e5f91da4a05928daf3ea6d6556b8111a6a02c6528b2f258a344e3059ca23
- SSDEEP 1536:q7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx1:DCSjGoLpWM6bblmjx1
- TLSH T191732A65B28CB776C0F2A9B88E0CF1E5BC257E301E19189BB5DE2F0DDA7B1C2560C195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\RCXEE14.tmp
- Size 83KB
- SHA256 a5032f3b5b62290de9240ff7047d7ec9c3c89ac0dd27fdf98fbd398c87289b6e
- MD5 b57885afcbcd71d7d8200a3975d94a8b
- SHA1 711d1e3abbe023bd10228c87b277e796f43cb91a
- SHA512 069589b4775529510b7469db35dc410f6da0d54a0ddd2dd94d5f234a984acac48b2ddc8127b6c5e8c10658f873ed3f25060e094a040139452a79b12b4cde554e
- SSDEEP 1536:u7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjx5qkSZZZ3X:/CSjGoLpWM6bblmjx7UX
- TLSH T1F1833855B68CB3B2D0F199B89E0CF3E5BD257E301E59185FB69E3F0E9A77082150C189
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.Exe
- Size 528KB
- SHA256 4fcc32df4599b9aa22c92cf55abfd2eda3316a85554d65caaa14ef4972f5189f
- MD5 e3b38520d256fde6644f9e06f0ba2385
- SHA1 ca62aecbf4891ba7df10062c078fc072e936c49f
- SHA512 b6ac924960a5715b25276912060729aeb13ce044b67656a5876d8ff06dc461fd316126b67f990c6bf5223c11c2decb5f6e6e8ec301ab6c5a67e8801db9100566
- SSDEEP 6144:1XmRmT78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:0e85bM3npxYfj63hgD1ZiL
- TLSH T169B4C40277EDB335F2F31B31AE7DB2615E7ABC619D35860E23841A0D49B0580EA75B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\RCX1EA.tmp
- Size 75KB
- SHA256 2fdf7a4777c50bd2c92249ac7d39d415d0651840e8d4ce879dc2f57b21272451
- MD5 8234be4dd875ec740a88c22dfa0841bc
- SHA1 831ec4852b384b3e35449bc8034f11be2a8c3830
- SHA512 c0466b76727da87bc401329fd3deacd7e379be9d46240e488c4b9e291ab98b70c45593613f59b8e60e75f04566396bfa8551a4617a7681b724f46ef4f0328edd
- SSDEEP 1536:W7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxHO:HCSjGoLpWM6bblmjxHO
- TLSH T129732965F28CB776C0F299B88E0DF1E5BC287E305E29189B769E2F0DDA7B1C2550C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$a5CB1.bat
- Size 1022B
- SHA256 8ae99db09d0a211b7c8768735a731f342a03921fb239fd5ff1cbb1011b22a731
- MD5 b47d8d9f0d905ac92d7d3bd657992a98
- SHA1 29b27f69506d6623414bc1cd887e07f43859d5bf
- SHA512 c8fccd9db0dfd92b384524faddd9ac39e4ed16e4cf26e4174b7056b055c88a67c4b9b6cee571e4f9ab15a43492ecea7f4e9e46dba1bca04779a89b9b9759f789
- TLSH T18311E607827FEFDB0581E00B9BB05E8B81253A5A374B33222358C65E94D284EF1E374B
- MD5 SHA1 SHA512 TLSH
2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-04-24_c05cd0d41581325ec03ab5d405f016cb_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe.exe
- Size 284KB
- SHA256 4dfadea4c0f21edeea184d18a3e18fda76ba032a9e36a5c787260195f6ab85b1
- MD5 a4dcdd8c0e0f54d180328b4c4232a30c
- SHA1 27153058e4627a3ee739435a5d7b78acd559ae84
- SHA512 73e7e78a747c4c1637f9c4f2839373ea15978d9711232cdcf03224aa5fd5401fc02eeaab09efbe131f42b530bd5277b5d0bc46a1ff38a9f7d61b42129172fd6a
- SSDEEP 6144:8TpPX6ADu79SiirlTeeGyfgCA/j6FyAO/Hsumwc4+Qx+jeZAVl:8TpiAvroeGyfgMy1Hs/wtx+je6Vl
- TLSH T19154AE0276E18072E9B215325978EA629AFD7D300931CABF23D44E1DDF71680D53ABB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 89KB
- SHA256 b89b79d5cbe998285bcc254020c647412a09f379bd8d637e59e862ec225e67aa
- MD5 4c2ebcd2127e329ebe52bfee6dec8470
- SHA1 dc1300faabc15fcaa095040ea4b6764a5a179e81
- SHA512 28cf02725dcaa2f0b1436f2e104247d74f11d9889755006e46726f5fa449debd94dbaeea387ffb7736839ecd6bef4656e79d43f062e30437e178865e93ecbc2e
- SSDEEP 1536:m7qnkAQtSaoGo5n4iLG0/WM6T3EKHSaYqemmjxxE5Rr:3CSjGoLpWM6bblmjxE
- TLSH T102934B65B18CF772D0F259B89E0CF2E1BC797E301E19189BB69D2F0DDA760C2191C296
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH