Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 13:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
- Size 5.6MB
- Sample260424-qa36csax51
- SHA256 1b56bb2838f58cded1e1333f589008d4a81b771485b774af9740ba4c13517cbc
- MD5 1ffb66b5b1c315055037118b08cb72e1
- SHA1 06a90705e092855ee399675cc741ec255888fc72
- SHA512 bb191e20c89beb3168913fc198603d0631f529d7986fbdcf1e4e34e1a192f7acd1bddf5c1b73e15adc52f974f702dc1647df79b7a74b3490ba884acb0840a246
- SSDEEP 98304:EcRGTymaYxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kf:3GTxaPeGZF6bUpMBF1p/kf
- TLSH T1AA460216F5A48276D073C179C4E2D77AEE7134921B3086CB5385CB6D6F632E2993A332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\smrss.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\smrss.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe 4232 2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_1ffb66b5b1c315055037118b08cb72e1_amadey_elex_luca-stealer_manuscrypt_njrat_remcos_rhadamanthys_smoke-loader_stop.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4232
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 6.1MB
- SHA256 3a3ac73af5869027bf5ce5a91636e03636c213758beddabdee06aabdbf7803b6
- MD5 90f03b0df50c2449f23555ed6d743118
- SHA1 3e0c4cd407101ea3c74f2733891e2eaed10702d3
- SHA512 267cd7279b1c8b8f0a15f427ba4e56ab8f18b73b806d8c6c99124e12f791b7aeb710c4454a95a930486ce17d1545c02350a563ba1382f75495104418f3317650
- SSDEEP 98304:EcRGTymaYxQeMjLsAAa/7JNzJwjI5klUigKYkBEvHPILz1p/kZjom:3GTxaPeGZF6bUpMBF1p/kNom
- TLSH T18056F116F5A48371D073C079C5E2E6BAEE7134821B308ACB5385C76D2F676E6993A331
- MD5 SHA1 SHA512 SSDEEP TLSH