fab93640b965373fb0bcdf1562e0636e8d146731bc3867ceb0c391ef5dcc0b34

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/05/2026, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 10.0MB
Sample260517-avfb2aey6p
SHA256 fab93640b965373fb0bcdf1562e0636e8d146731bc3867ceb0c391ef5dcc0b34
MD5 e5aa96dede0f0275c1d4526e24b5fd1a
SHA1 d13a8937bdb70adb0bd5b02532cc6d8fdd7e01a9
SHA512 601e458f61eb81e0f6e9c9732aac17f9dc0c985ccb49fbb0fdcf67d98b51b7f9a420b9bc95d569dbc6add3d21c342a77713506dfcca18a82a3780167624221d8
SSDEEP 49152:0+7qORqUfLb4dx3lt/SbL0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L5:znqUc3raU
TLSH
T15CB61291B71FC3CAD5C9C4B123F905E73E0AB35027262EF90195994B9AFA481327B6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2564	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2564	WMIC.exe
Token: SeSecurityPrivilege	2564	WMIC.exe
Token: SeTakeOwnershipPrivilege	2564	WMIC.exe
Token: SeLoadDriverPrivilege	2564	WMIC.exe
Token: SeSystemProfilePrivilege	2564	WMIC.exe
Token: SeSystemtimePrivilege	2564	WMIC.exe
Token: SeProfSingleProcessPrivilege	2564	WMIC.exe
Token: SeIncBasePriorityPrivilege	2564	WMIC.exe
Token: SeCreatePagefilePrivilege	2564	WMIC.exe
Token: SeBackupPrivilege	2564	WMIC.exe
Token: SeRestorePrivilege	2564	WMIC.exe
Token: SeShutdownPrivilege	2564	WMIC.exe
Token: SeDebugPrivilege	2564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2564	WMIC.exe
Token: SeRemoteShutdownPrivilege	2564	WMIC.exe
Token: SeUndockPrivilege	2564	WMIC.exe
Token: SeManageVolumePrivilege	2564	WMIC.exe
Token: 33	2564	WMIC.exe
Token: 34	2564	WMIC.exe
Token: 35	2564	WMIC.exe
Token: 36	2564	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2564	WMIC.exe
Token: SeSecurityPrivilege	2564	WMIC.exe
Token: SeTakeOwnershipPrivilege	2564	WMIC.exe
Token: SeLoadDriverPrivilege	2564	WMIC.exe
Token: SeSystemProfilePrivilege	2564	WMIC.exe
Token: SeSystemtimePrivilege	2564	WMIC.exe
Token: SeProfSingleProcessPrivilege	2564	WMIC.exe
Token: SeIncBasePriorityPrivilege	2564	WMIC.exe
Token: SeCreatePagefilePrivilege	2564	WMIC.exe
Token: SeBackupPrivilege	2564	WMIC.exe
Token: SeRestorePrivilege	2564	WMIC.exe
Token: SeShutdownPrivilege	2564	WMIC.exe
Token: SeDebugPrivilege	2564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2564	WMIC.exe
Token: SeRemoteShutdownPrivilege	2564	WMIC.exe
Token: SeUndockPrivilege	2564	WMIC.exe
Token: SeManageVolumePrivilege	2564	WMIC.exe
Token: 33	2564	WMIC.exe
Token: 34	2564	WMIC.exe
Token: 35	2564	WMIC.exe
Token: 36	2564	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4548	WMIC.exe
Token: SeSecurityPrivilege	4548	WMIC.exe
Token: SeTakeOwnershipPrivilege	4548	WMIC.exe
Token: SeLoadDriverPrivilege	4548	WMIC.exe
Token: SeSystemProfilePrivilege	4548	WMIC.exe
Token: SeSystemtimePrivilege	4548	WMIC.exe
Token: SeProfSingleProcessPrivilege	4548	WMIC.exe
Token: SeIncBasePriorityPrivilege	4548	WMIC.exe
Token: SeCreatePagefilePrivilege	4548	WMIC.exe
Token: SeBackupPrivilege	4548	WMIC.exe
Token: SeRestorePrivilege	4548	WMIC.exe
Token: SeShutdownPrivilege	4548	WMIC.exe
Token: SeDebugPrivilege	4548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4548	WMIC.exe
Token: SeRemoteShutdownPrivilege	4548	WMIC.exe
Token: SeUndockPrivilege	4548	WMIC.exe
Token: SeManageVolumePrivilege	4548	WMIC.exe
Token: 33	4548	WMIC.exe
Token: 34	4548	WMIC.exe
Token: 35	4548	WMIC.exe
Token: 36	4548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4548	WMIC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 5012	4864	2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe	86
PID 5012 wrote to memory of 2564	5012	cmd.exe	88
PID 4864 wrote to memory of 2472	4864	2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe	91
PID 2472 wrote to memory of 4548	2472	cmd.exe	94
PID 4864 wrote to memory of 1108	4864	2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe	96
PID 1108 wrote to memory of 2976	1108	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C wmic path win32_VideoController get name /value > "C:\Users\Admin\AppData\Local\Temp\wqB532.tmp" 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name /value
    3⤵
    - System Location Discovery: System Language Discovery
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C wmic cpu get name /value > "C:\Users\Admin\AppData\Local\Temp\wqB756.tmp" 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name /value
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C wmic computersystem get model /value > "C:\Users\Admin\AppData\Local\Temp\wqB860.tmp" 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic computersystem get model /value
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wqB532.tmp

Path C:\Users\Admin\AppData\Local\Temp\wqB532.tmp
Size 68B
SHA256 8f90b64fdb76c56bf6ee420ed901ae3dd0283d5600f3938986ed76675235c550
MD5 f1508071541c174b485aa59427e62e3a
SHA1 5d0748ec53d4b171c2edc07427f6541ff06049ea
SHA512 bfd8a1d12b878afcb799147b6a3c1d233ce304c8ecd93acab8aa9f99c34ee31bce813e22223745518b5195181877a746aa483461c3288b504727d6aee947afaa
TLSH
T162A0025B75ED0058A052A2C9437304B91B153630903E4CDC01C7158351D0C416B073D7
MD5 SHA1 SHA512 TLSH

Submit Download

wqB756.tmp

Path C:\Users\Admin\AppData\Local\Temp\wqB756.tmp
Size 96B
SHA256 68d3f3b2fab03a79adc3733264061229fcdc73e8600b7a55fe46ee5ddae66fdf
MD5 5dd5078f525a667412a956afa2148625
SHA1 7ac0572dcd70a7e036df3c03f3d9a910fe1ade21
SHA512 c6bea60dda8e211b23131fbcaa11a731da16cb0ab10396f023c51e0f0af1ab69b443657b750b08c242dee3939ee6caf4c61bb5cdf74ce806df3c4e5ad322dae0
TLSH
T1B1B0121373F2400470712DC0B83205B8037178301E2C4CEF00C0144405F0C5886283C7
MD5 SHA1 SHA512 TLSH

Submit Download

wqB860.tmp

Path C:\Users\Admin\AppData\Local\Temp\wqB860.tmp
Size 78B
SHA256 bc30353ac49a19d84786fff4b5ed666610dfd05e98b637c6e80c9cbe6af653e6
MD5 35a40599b8d212eb54606b643c3e1353
SHA1 0680e538f58ae780ae4e54b480b187e48b76b708
SHA512 bc5636678b11f8a89604a589ac8a28fd06598797381c91fa09eebfffa182bb9fa2d525964643d85536f80fb2b9bfd816619cd7fb9e50b0174d80d39249cb7c47
TLSH
T101A0021772F44550663109E4EF731831432F74A24A3D4CDE15D1C0991DE0EA541757C3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads