Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 15:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
- Size 839KB
- Sample260511-shlbmacz5s
- SHA256 21026f6309773e45145a0fe52a2adb7dabfecfc6f73e23aa0432f742b4533f33
- MD5 95aa88c4be65b9d2bcdcddf3b16d77b1
- SHA1 7c0b8238210fbaddc433f4028944c7c86375450c
- SHA512 7992433cbe9b69a49b7cb29e2ae78fd739b169a99825c6d3ff2b3ab3b3b87830eb2f4bf690f6006d4aec1593c9215885c52c5a9b3292ced313d51c563cf5ccb2
- SSDEEP 24576:B5hVZ2zEYytjjqNSlhvpfQiIhKPtehfQwr9qySkbged:HZPtjtQiIhUyQy1SkFd
- TLSH T1A305AE12B592C033E06211B15978ABB6997EBD340B3195DB67C80F5D4E345C2AF3AB3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4352 Logo1_.exe 4692 2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe Logo1_.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Logo1_.exe 2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\virDll.dll Logo1_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe 4352 Logo1_.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5368 wrote to memory of 1112 5368 2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 85 PID 5368 wrote to memory of 4352 5368 2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 86 PID 1112 wrote to memory of 4692 1112 cmd.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBC5.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4692
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4352
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1022KB
- SHA256 df93d12c42c4f28487891aafe3407875034c84fb5745ef6aa198ed2306bcb9f1
- MD5 e5e1fe552c750877733d1e40224697f9
- SHA1 c3a04d29c0cf8c413269ec26607e3e5b3bd0e590
- SHA512 92533f206c591dabc7bcdc8c0a1a269b4e4edef4a8d21566d2df5b62b08d8d0078ce42a493de2d0cc61c5544750515ec75bc9e5f9566300119498b794169db96
- SSDEEP 12288:B5hVG8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:B5hVja7/ezSC6vUyD/aqgrvWx6q8wyu
- TLSH T13125F915F5788333D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aFBC5.bat
- Size 998B
- SHA256 7ee6f7381eb20b549554fb7d17aae43870cd89edf43b5b451bcb1d398bccc9fd
- MD5 c3359a3f06dbb80e42e766ec683da71f
- SHA1 9c69cf05f6422246fff8c4c3206421208c02b483
- SHA512 6fb91f7a6820cb17ec9cb20cb4e1eb17632c999d1977abc7c180bbf6ee9de9d2f98dc9246003b13da91aa685bc35092d3e69da412bb8b5ba06529aea0b8178b7
- TLSH T1C2110B4B81BFCF570199E00B4B725ECFC2EA275627572311B3F48B1E20E009E69D638A
- MD5 SHA1 SHA512 TLSH
2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_95aa88c4be65b9d2bcdcddf3b16d77b1_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe
- Size 781KB
- SHA256 2ad0dedcda48a899960f06b90b0fb9d08c83fef416f616ce359340fce4886eb4
- MD5 c9f853de1e78fc0dedfed88e35f127f8
- SHA1 36da03865c8337aab2f4bfac4b2195554e84a0e4
- SHA512 c1ace7f8e72af4929d4e1804882889b4e6e8cc60b616680412695ef259bc2ccd61d6040d92ef31f3a8a214e55ca66c0468823074b330fd1dd32428e0a5eb71f9
- SSDEEP 24576:R2zEYytjjqNSlhvpfQiIhKPtehfQwr9qySkbged:RPtjtQiIhUyQy1SkFd
- TLSH T115059E12B592C033E0A211B15578AB769DBEBD340B3195DB67C80A5D4F346C2AF36B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 58KB
- SHA256 40d0173de8e10325c41ee11b209ae24082b38aaa02677bf08ec179dcc477b777
- MD5 9b43e7fd3ffad6bcd2316efb5d52a8ad
- SHA1 73ca81f0249e0402d53b50fc80c3f8b83160ccb1
- SHA512 e9d4f41a4c5d030c82afd0c858877dc49586baab1723d7b8d0156353825bb645aef957eedf05ca8fc6884afe911793d4046c99a4636d79f9126fd4d541a77b6b
- SSDEEP 1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmit:qKtfDwsjPThTYszDH2f
- TLSH T14343AF97FE90CC72D02818FC9D19C2D6F2BAB5702D1A1961BAFA9F0CDC2B2D2551C257
- MD5 SHA1 SHA512 SSDEEP TLSH