Analysis
- max time kernel
149s - max time network
71s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 00:31
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe
- Size 10.0MB
- Sample260517-avfb2aey6p
- SHA256 fab93640b965373fb0bcdf1562e0636e8d146731bc3867ceb0c391ef5dcc0b34
- MD5 e5aa96dede0f0275c1d4526e24b5fd1a
- SHA1 d13a8937bdb70adb0bd5b02532cc6d8fdd7e01a9
- SHA512 601e458f61eb81e0f6e9c9732aac17f9dc0c985ccb49fbb0fdcf67d98b51b7f9a420b9bc95d569dbc6add3d21c342a77713506dfcca18a82a3780167624221d8
- SSDEEP 49152:0+7qORqUfLb4dx3lt/SbL0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L0L5:znqUc3raU
- TLSH T15CB61291B71FC3CAD5C9C4B123F905E73E0AB35027262EF90195994B9AFA481327B6CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2816 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2816 WMIC.exe Token: SeSecurityPrivilege 2816 WMIC.exe Token: SeTakeOwnershipPrivilege 2816 WMIC.exe Token: SeLoadDriverPrivilege 2816 WMIC.exe Token: SeSystemProfilePrivilege 2816 WMIC.exe Token: SeSystemtimePrivilege 2816 WMIC.exe Token: SeProfSingleProcessPrivilege 2816 WMIC.exe Token: SeIncBasePriorityPrivilege 2816 WMIC.exe Token: SeCreatePagefilePrivilege 2816 WMIC.exe Token: SeBackupPrivilege 2816 WMIC.exe Token: SeRestorePrivilege 2816 WMIC.exe Token: SeShutdownPrivilege 2816 WMIC.exe Token: SeDebugPrivilege 2816 WMIC.exe Token: SeSystemEnvironmentPrivilege 2816 WMIC.exe Token: SeRemoteShutdownPrivilege 2816 WMIC.exe Token: SeUndockPrivilege 2816 WMIC.exe Token: SeManageVolumePrivilege 2816 WMIC.exe Token: 33 2816 WMIC.exe Token: 34 2816 WMIC.exe Token: 35 2816 WMIC.exe Token: 36 2816 WMIC.exe Token: SeIncreaseQuotaPrivilege 2816 WMIC.exe Token: SeSecurityPrivilege 2816 WMIC.exe Token: SeTakeOwnershipPrivilege 2816 WMIC.exe Token: SeLoadDriverPrivilege 2816 WMIC.exe Token: SeSystemProfilePrivilege 2816 WMIC.exe Token: SeSystemtimePrivilege 2816 WMIC.exe Token: SeProfSingleProcessPrivilege 2816 WMIC.exe Token: SeIncBasePriorityPrivilege 2816 WMIC.exe Token: SeCreatePagefilePrivilege 2816 WMIC.exe Token: SeBackupPrivilege 2816 WMIC.exe Token: SeRestorePrivilege 2816 WMIC.exe Token: SeShutdownPrivilege 2816 WMIC.exe Token: SeDebugPrivilege 2816 WMIC.exe Token: SeSystemEnvironmentPrivilege 2816 WMIC.exe Token: SeRemoteShutdownPrivilege 2816 WMIC.exe Token: SeUndockPrivilege 2816 WMIC.exe Token: SeManageVolumePrivilege 2816 WMIC.exe Token: 33 2816 WMIC.exe Token: 34 2816 WMIC.exe Token: 35 2816 WMIC.exe Token: 36 2816 WMIC.exe Token: SeIncreaseQuotaPrivilege 4284 WMIC.exe Token: SeSecurityPrivilege 4284 WMIC.exe Token: SeTakeOwnershipPrivilege 4284 WMIC.exe Token: SeLoadDriverPrivilege 4284 WMIC.exe Token: SeSystemProfilePrivilege 4284 WMIC.exe Token: SeSystemtimePrivilege 4284 WMIC.exe Token: SeProfSingleProcessPrivilege 4284 WMIC.exe Token: SeIncBasePriorityPrivilege 4284 WMIC.exe Token: SeCreatePagefilePrivilege 4284 WMIC.exe Token: SeBackupPrivilege 4284 WMIC.exe Token: SeRestorePrivilege 4284 WMIC.exe Token: SeShutdownPrivilege 4284 WMIC.exe Token: SeDebugPrivilege 4284 WMIC.exe Token: SeSystemEnvironmentPrivilege 4284 WMIC.exe Token: SeRemoteShutdownPrivilege 4284 WMIC.exe Token: SeUndockPrivilege 4284 WMIC.exe Token: SeManageVolumePrivilege 4284 WMIC.exe Token: 33 4284 WMIC.exe Token: 34 4284 WMIC.exe Token: 35 4284 WMIC.exe Token: 36 4284 WMIC.exe Token: SeIncreaseQuotaPrivilege 4284 WMIC.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4160 wrote to memory of 1048 4160 2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe 78 PID 1048 wrote to memory of 2816 1048 cmd.exe 80 PID 4160 wrote to memory of 3344 4160 2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe 82 PID 3344 wrote to memory of 4284 3344 cmd.exe 84 PID 4160 wrote to memory of 3804 4160 2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe 85 PID 3804 wrote to memory of 3448 3804 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_e5aa96dede0f0275c1d4526e24b5fd1a_amadey_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.execmd.exe /C wmic path win32_VideoController get name /value > "C:\Users\Admin\AppData\Local\Temp\wq5E09.tmp" 2>nul2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- System Location Discovery: System Language Discovery
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C wmic cpu get name /value > "C:\Users\Admin\AppData\Local\Temp\wq5FDF.tmp" 2>nul2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name /value3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C wmic computersystem get model /value > "C:\Users\Admin\AppData\Local\Temp\wq609B.tmp" 2>nul2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem get model /value3⤵
- System Location Discovery: System Language Discovery
PID:3448
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wq5E09.tmp
- Size 68B
- SHA256 8f90b64fdb76c56bf6ee420ed901ae3dd0283d5600f3938986ed76675235c550
- MD5 f1508071541c174b485aa59427e62e3a
- SHA1 5d0748ec53d4b171c2edc07427f6541ff06049ea
- SHA512 bfd8a1d12b878afcb799147b6a3c1d233ce304c8ecd93acab8aa9f99c34ee31bce813e22223745518b5195181877a746aa483461c3288b504727d6aee947afaa
- TLSH T162A0025B75ED0058A052A2C9437304B91B153630903E4CDC01C7158351D0C416B073D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wq5FDF.tmp
- Size 96B
- SHA256 68d3f3b2fab03a79adc3733264061229fcdc73e8600b7a55fe46ee5ddae66fdf
- MD5 5dd5078f525a667412a956afa2148625
- SHA1 7ac0572dcd70a7e036df3c03f3d9a910fe1ade21
- SHA512 c6bea60dda8e211b23131fbcaa11a731da16cb0ab10396f023c51e0f0af1ab69b443657b750b08c242dee3939ee6caf4c61bb5cdf74ce806df3c4e5ad322dae0
- TLSH T1B1B0121373F2400470712DC0B83205B8037178301E2C4CEF00C0144405F0C5886283C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wq609B.tmp
- Size 78B
- SHA256 bc30353ac49a19d84786fff4b5ed666610dfd05e98b637c6e80c9cbe6af653e6
- MD5 35a40599b8d212eb54606b643c3e1353
- SHA1 0680e538f58ae780ae4e54b480b187e48b76b708
- SHA512 bc5636678b11f8a89604a589ac8a28fd06598797381c91fa09eebfffa182bb9fa2d525964643d85536f80fb2b9bfd816619cd7fb9e50b0174d80d39249cb7c47
- TLSH T101A0021772F44550663109E4EF731831432F74A24A3D4CDE15D1C0991DE0EA541757C3
- MD5 SHA1 SHA512 TLSH