c97f9e65b1f9aa063fbd8c73a92910bce09b132923b75c6deffe93e450b3e209

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Size 896KB
Sample260522-psl45abs4k
SHA256 c97f9e65b1f9aa063fbd8c73a92910bce09b132923b75c6deffe93e450b3e209
MD5 f1705a28c09b8e4ebdcacd4b523cd941
SHA1 b48dbcb9a5dd9fa4f6d578e3b988ac823b310af7
SHA512 a3c2f3f56d8323081ce1ccbd6e161c00412997157c2b8618a4ef2969e3ba3af100cc9708912825868862f88c0d2fd865610cb42128ef06db34ce7585dd664983
SSDEEP 12288:mDb22DShTEe+yuyzGybMFNNluDb22DShTEe+yuyzGybMFNNl1:EK2eTEe+YBMFNNGK2eTEe+YBMFNNn
TLSH
T10915E016B8C18072D472343202619BB55B3EF83021A99ACF87591D76EF726D19B3A3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2244	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp
3436	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm
5060	YZH.exe
3004	YZH.exe
4980	YZH.sys

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\B:	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/756-0-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/files/0x0014000000025bb9-5.dat	upx
behavioral2/files/0x001e00000002b407-7.dat	upx
behavioral2/memory/2244-8-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/2244-14-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3436-16-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-22-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/2244-33-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3436-31-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4980-29-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-19-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3436-13-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/4980-35-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/756-34-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-87-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-88-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-89-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/756-90-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-92-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-91-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-94-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-95-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-97-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-98-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-100-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-101-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-103-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-104-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-106-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-107-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-109-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-110-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-112-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-113-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-115-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-116-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-118-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-119-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-122-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-121-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-124-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-125-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-127-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-128-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5060-130-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3004-131-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\YZH.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm
File opened for modification	C:\Windows\YZH.exe	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm
File created	C:\Windows\YZH.exe	YZH.exe
File created	C:\Windows\YZH.sys	YZH.exe
File opened for modification	C:\Windows\YZH.sys	YZH.exe
File created	C:\Windows\YZH.exe	YZH.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.sys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
756	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
756	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
2244	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp
2244	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp
5060	YZH.exe
5060	YZH.exe
5060	YZH.exe
5060	YZH.exe
5060	YZH.exe
5060	YZH.exe
5060	YZH.exe
5060	YZH.exe
3004	YZH.exe
3004	YZH.exe
3004	YZH.exe
3004	YZH.exe
3004	YZH.exe
3004	YZH.exe
3004	YZH.exe
3004	YZH.exe
3004	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
3004	YZH.exe
5060	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe
3004	YZH.exe
5060	YZH.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5060	YZH.exe
3004	YZH.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2244	756	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	80
PID 756 wrote to memory of 3436	756	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	81
PID 3436 wrote to memory of 5060	3436	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm	82
PID 2244 wrote to memory of 3004	2244	2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp	83
PID 3004 wrote to memory of 4980	3004	YZH.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp
  C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\YZH.exe
    C:\Windows\YZH.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\YZH.sys
      C:\Windows\YZH.sys /zhj
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4980
- C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm
  C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm /zhj
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\YZH.exe
    C:\Windows\YZH.exe /zhj
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm

Path C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.mm
Size 448KB
SHA256 e68390a490884afec23f9a8e81577c216ded137794ca8034e1d7f994ce106bfc
MD5 b937b7461ec37f036a51fda0eb5a85e9
SHA1 4271ac981589e7380320e7565366a4839d671baf
SHA512 af11b96c696840647adcbcf431b15301f12f1bb174e54039c0d4583dd08c18734409a3db0f27b05c145dc8d82dd521d68007db5f6fecf6bad2619713c5976f4f
SSDEEP 6144:mvrb22uGLbWhTjYVM+RwxuybHGybMb3Q/W7Gj4NlTol:mDb22DShTEe+yuyzGybMFNNlE
TLSH
T197A4D016B8C18072D872343102619BB55B3EF83025A99ACF87590D76EF726D19B3A3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp

Path C:\Users\Admin\AppData\Local\Temp\2026-05-22_f1705a28c09b8e4ebdcacd4b523cd941_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.tmp
Size 448KB
SHA256 d30131000b4f1679f648f1101c8462c44cb0f4d776211fa508505d0571d02eeb
MD5 f1a15159196f2b2fab72d0895cd92c51
SHA1 d67632ce44fc21801cbcd0074145397b3c43320a
SHA512 dc25a510df62c7f9e9c17b80980596ce435d3b8fd6733312255523fa8db7669d3ad81923ea9cd895f82767a185cd7263a71574a3379cf9b10b7462310e0a152b
SSDEEP 6144:7vrb22uGLbWhTjYVM+RwxuybHGybMb3Q/W7Gj4NlTol:7Db22DShTEe+yuyzGybMFNNlE
TLSH
T171A4E016B8C08072D472343202619BB55B3EF83025A99ACFC7591D76EF726D19B2A3DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/756-1-0x000000000043E000-0x000000000043F000-memory.dmp

Download

memory/756-90-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/756-34-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2244-8-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2244-14-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/2244-33-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-22-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-125-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-110-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-104-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-113-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-107-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-131-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-128-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-89-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-101-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-92-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-116-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-122-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-95-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-119-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3004-98-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3436-16-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3436-13-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3436-31-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4980-29-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/4980-35-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-19-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-109-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-106-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-112-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-103-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-115-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-100-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-118-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-97-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-94-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-121-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-124-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-91-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-127-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-88-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-130-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5060-87-0x0000000000400000-0x000000000043F000-memory.dmp

Download