spectre_rat | 75289f03827bb2d7a7c01a1a6cb66f8aa51f389465d857f56e3405b2ee6e3117

General

Target
2026-06-01_5150a33cae626546bbf758c0383b09dc_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
Size 400KB
Sample260601-pyra2acv7t
SHA256 75289f03827bb2d7a7c01a1a6cb66f8aa51f389465d857f56e3405b2ee6e3117
MD5 5150a33cae626546bbf758c0383b09dc
SHA1 ca5b9e496b10ee79cf3e4bfd29f7298c120a8800
SHA512 67dd480456d5ea1195a40ddaa59b3c24695f6696db0abe82d841dc6802dd7b6e7ce0c76cfc1a8ed91af607686129b5924d727d2c7b19fe030773f22faad5c1f2
SSDEEP 12288:j+nfcwcfE/nJH951IvVPpp6Cl4C0NiH/FRHkle6lydOGzEqSRG0nmc/75O0K0ry7:a0wckDacby08KwX5GstHpz2PDWQMEtrQ
TLSH
T13E948C1174C6C0B6E27202314DA5FA2946EE7D701E714E6BB7D88E566F78891C232FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery spectre_rat triumphloader loader rat trojan

Malware Config

Signatures

Family: SpectreRat
SpectreRat is a RAT and backdoor written in C++.
rat spectre_rat
Family: TriumphLoader
TriumphLoader is a c++ loader based on the open source AbsentLoader.
trojan loader triumphloader

Detects SpectreRat payload 2 IoCs

resource	yara_rule
behavioral2/memory/908-0-0x0000000000C50000-0x0000000000CB9000-memory.dmp	family_spectrerat
behavioral2/memory/908-1-0x0000000000C50000-0x0000000000CB9000-memory.dmp	family_spectrerat

TriumphLoader payload 2 IoCs

resource	yara_rule
behavioral2/memory/908-0-0x0000000000C50000-0x0000000000CB9000-memory.dmp	family_triumphloader
behavioral2/memory/908-1-0x0000000000C50000-0x0000000000CB9000-memory.dmp	family_triumphloader

Detects TriumphLoader 2 IoCs

resource	yara_rule
behavioral2/memory/908-0-0x0000000000C50000-0x0000000000CB9000-memory.dmp	INDICATOR_EXE_Packed_TriumphLoader
behavioral2/memory/908-1-0x0000000000C50000-0x0000000000CB9000-memory.dmp	INDICATOR_EXE_Packed_TriumphLoader

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_5150a33cae626546bbf758c0383b09dc_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4848	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3788	timeout.exe
4176	timeout.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
908	2026-06-01_5150a33cae626546bbf758c0383b09dc_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1936	908	2026-06-01_5150a33cae626546bbf758c0383b09dc_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe	81
PID 908 wrote to memory of 3284	908	2026-06-01_5150a33cae626546bbf758c0383b09dc_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe	83
PID 908 wrote to memory of 4848	908	2026-06-01_5150a33cae626546bbf758c0383b09dc_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe	85
PID 3284 wrote to memory of 3788	3284	cmd.exe	87
PID 1936 wrote to memory of 3912	1936	cmd.exe	88
PID 4848 wrote to memory of 3672	4848	cmd.exe	89
PID 4848 wrote to memory of 4176	4848	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-01_5150a33cae626546bbf758c0383b09dc_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_5150a33cae626546bbf758c0383b09dc_amadey_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\ae4dc445282c9251" /v Lw5UOC4Bw6TCh8K/w60= /t REG_SZ /d C:\ProgramData\gOsVhAAEC74gCWtu7I
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\ae4dc445282c9251" /v Lw5UOC4Bw6TCh8K/w60= /t REG_SZ /d C:\ProgramData\gOsVhAAEC74gCWtu7I
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C timeout /t 600 && SCHTASKS /Create /SC MINUTE /MO 3 /TN NetworkConfiguration /TR C:\ProgramData\gOsVhAAEC74gCWtu7I\NetworkConfigurationSvc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 600
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\ae4dc445282c9251" /v agUiwqXDgQXCsGs= /t REG_SZ /d C:\ProgramData\gOsVhAAEC74gCWtu7I\NetworkConfigurationSvc.exe && timeout /t 840 && tasklist /fo csv |>nul find /i "NetworkConfigurationSvc.exe" || start C:\ProgramData\gOsVhAAEC74gCWtu7I\NetworkConfigurationSvc.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Software\ae4dc445282c9251" /v agUiwqXDgQXCsGs= /t REG_SZ /d C:\ProgramData\gOsVhAAEC74gCWtu7I\NetworkConfigurationSvc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3672
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 840
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/908-0-0x0000000000C50000-0x0000000000CB9000-memory.dmp

Download

memory/908-1-0x0000000000C50000-0x0000000000CB9000-memory.dmp