Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
- Size 5.6MB
- Sample260424-qa36csax51
- SHA256 1b56bb2838f58cded1e1333f589008d4a81b771485b774af9740ba4c13517cbc
- MD5 1ffb66b5b1c315055037118b08cb72e1
- SHA1 06a90705e092855ee399675cc741ec255888fc72
- SHA512 bb191e20c89beb3168913fc198603d0631f529d7986fbdcf1e4e34e1a192f7acd1bddf5c1b73e15adc52f974f702dc1647df79b7a74b3490ba884acb0840a246
- SSDEEP 98304:EcRGTymaYxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kf:3GTxaPeGZF6bUpMBF1p/kf
- TLSH T1AA460216F5A48276D073C179C4E2D77AEE7134921B3086CB5385CB6D6F632E2993A332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\smrss.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 1952 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 6.1MB
- SHA256 4b69a6fc3d9b849039fbc8ce8847439f59d6095ca73234d2f378813a86b5c383
- MD5 4e7cf6a3f775b3dc5dfa3d731473925b
- SHA1 4fc5c93f93c11904f9774901befb54b423652d66
- SHA512 c42f0b80cf3d94865873eeb799d6ac71be3a4f592b9efc4a2c82d152ce176e02adf4c825ce4ba73bd1a0c4410dc005a7138f734f20561b55e591c25b9fd5bca0
- SSDEEP 98304:EcRGTymaYxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kZjoj:3GTxaPeGZF6bUpMBF1p/kNoj
- TLSH T19956F116F5A48371D073C079C5E2E6BAEE7134821B308ACB5385C76D2F676E6993A331
- MD5 SHA1 SHA512 SSDEEP TLSH