8139ad5be3ec6d3b6b0e5c9483a1150575cc88df3c989d1f709ad6509f49962d

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_80c4af13135c5e1267b080d9861963a8_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
Size 161KB
Sample260426-e9qtjadw3v
SHA256 8139ad5be3ec6d3b6b0e5c9483a1150575cc88df3c989d1f709ad6509f49962d
MD5 80c4af13135c5e1267b080d9861963a8
SHA1 1178b459860357ecd7fb025caefb2857d65d530f
SHA512 35fed4160a4f22f1ead970db4496a523eef584fb09fbb8ec856d7f4e054be0e4f405a51103953683ffd884ad31cb4b44d93cb7071fc5b26348d68cd85b419e1e
SSDEEP 3072:qHWQ0eRqhcYjpDftOVh3Wo/L5fhv9T5qJijUp2D82b2YLeqc09eaDPdDogi8EDpV:qHW0qEVh3Wojph//jUwA2bdeqHeGd8qu
TLSH
T1A7F38C01BC91C072E52315315975EA625ABD7E301FB0EE9BA7840B394F702C29636EBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	1	217.160.70.42	4972	2026-04-26_80c4af13135c5e1267b080d9861963a8_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4328	4972	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_80c4af13135c5e1267b080d9861963a8_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	2026-04-26_80c4af13135c5e1267b080d9861963a8_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
4972	2026-04-26_80c4af13135c5e1267b080d9861963a8_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-26_80c4af13135c5e1267b080d9861963a8_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_80c4af13135c5e1267b080d9861963a8_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 668
  2⤵
  - Program crash
  PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4972 -ip 4972
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4972-0-0x0000000001320000-0x0000000001922000-memory.dmp

Download