f5f12694e86b82785c1c83815de10b6a400f2650cf5b41af0b6be0fa12ed9791

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 874KB
Sample260704-eqa9qsay2t
SHA256 f5f12694e86b82785c1c83815de10b6a400f2650cf5b41af0b6be0fa12ed9791
MD5 99ca2fc816e12a885f4c51eb49c1f6e6
SHA1 d7302a9d4b4e0eda5cfa4d50a5ee5207f72342f7
SHA512 5c4dcf122109718a93b61988bd4d9319bece672156387ca84c1e8d1a98cc1e24254aac62374ac5b8922be2dcf826c902bbe949b13be503ff6fceca162e82fada
SSDEEP 24576:es2zEYytjjqNSlhvpfQiIhKPtehfQwr9qySkbged:esPtjtQiIhUyQy1SkFd
TLSH
T17B159D12B59EF332D0E200B1597CBBB69D7DBD240B3145DB67C80A5D4A345C1AE3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (261) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Logo1_.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	rundl132.exe

Executes dropped EXE 3 IoCs

pid	Process
4708	Logo1_.exe
4192	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4376	rundl132.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe"	Logo1_.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\RCXCADA.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXD92E.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCXD94F.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\RCXCC7C.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCXCB1A.tmp	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe.Exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCXD5A7.tmp	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	Logo1_.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe	Logo1_.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	Logo1_.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe.Exe	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.Exe	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\uninstall\rundl132.exe	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\Logo1_.exe	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\uninstall\rundl132.exe	Logo1_.exe
File created	C:\Windows\RichDll.dll	Logo1_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundl132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe
4708	Logo1_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3848	4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	86
PID 3848 wrote to memory of 1784	3848	net.exe	88
PID 4792 wrote to memory of 1684	4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	89
PID 4792 wrote to memory of 4708	4792	2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe	90
PID 4708 wrote to memory of 4448	4708	Logo1_.exe	92
PID 1684 wrote to memory of 4192	1684	cmd.exe	94
PID 4448 wrote to memory of 4684	4448	net.exe	95
PID 4708 wrote to memory of 3096	4708	Logo1_.exe	98
PID 3096 wrote to memory of 4220	3096	net.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\net.exe
  net stop "Kingsoft AntiVirus Service"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C0A.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4192
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4684
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4220

C:\Windows\uninstall\rundl132.exe
C:\Windows\uninstall\rundl132.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARM.exe.Exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe.Exe
Size 1.2MB
SHA256 7f769092c1ba875689e0a8bad11d4bb3c3994fa8d1c66df76e5a5e3176e06aa7
MD5 46b26b0edff814efac42a2f4d7a598b8
SHA1 0f3bf8e889211ffac3edf958eeebddd58af3d36a
SHA512 4e18fd59d789c67fde886db7935449ffa0ec979e105cef9eb75792ae90b3c5e0ac9d1821285018558455f79a9f1ec5738444a6533726d5bd776568495329505f
SSDEEP 24576:WeSgouvz0ZRHkFfenxyQZXS7gZnQh2NIq:WeSgouvAeFfenxyQZXS7uQ0NIq
TLSH
T16455C40267FD7329F1F37B71EABDB2645E767C61AE39C50E5284025E09B0A909A31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe.Exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe
Size 5.8MB
SHA256 ec5b6178b677a9400603c35e964c3205b1af07393a7aa2169acb2739838b0047
MD5 c64f33af84f480dd794894425e997018
SHA1 b4eac37455ba8d5b9fcf89320101bfb73fd92647
SHA512 5647f634630a2b2148e01f2ffee8c711966501ae290bd31a2fe647bacaa5796b57658a782d94548a1bd6861712c147bed79b73fab7ca14aa0d1c90536a62a24e
SSDEEP 98304:2og5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:2og1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
TLSH
T13A567B23A4E46130E5F332756D2CA7395D327FA29F3145CB86906C946FB82D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD8BE.tmp

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\RCXD8BE.tmp
Size 103KB
SHA256 a307651c18988c1dd13fb36f9eab06b6c31cd36fd22cc604cb137ca569e4b419
MD5 038c28febe3d553f6419e61b86835a6b
SHA1 e0f12c7e005e14e9540a3524d923ad59fa1acaa3
SHA512 2adc5f2926c5bfec06f5413577026fa30c2709ac9596e31203b7c987ad7f48a75c9d80245b9f265640450bda01f62b8bc2d938e608853e54c964881074f7544e
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLM1XkSPsULMHi4NQ:YCSjGoLpWM6VbBgjxpxi3MAdtPlLqtu
TLSH
T163A37C1AB28DB376D0E199BC8E0DF2E4BD397D301F19186FB29E1F0D9A765C2190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXD744.tmp

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD744.tmp
Size 118KB
SHA256 3dc7ac166d364a3bafc320bb1231d42483dc374f512b5585e45bd8de0afc7afe
MD5 4b1c50c33032935a7eebdc2704588a4c
SHA1 d557ad3c22defdbc71ba97e0ec03ff17500f8a09
SHA512 1f48f386e44b787f8266704a86d061046cef51c85ae51eac769f72fa3579a51bf2cc8b13fe08943b54aaff6a0c67e0e3dfcc5a7a8e0bde44af4308109db93b7a
SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLx4GZjzQwK5WW7VCa:FCSjGoLpWM6VbBgjxzxi3Mje5BV0SH
TLSH
T19DC3AE5AB28CB377C0E199B88E0DF2E4BD797E301E29086FB5991F0DCA7B5C1590C192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe.Exe

Path C:\Program Files\7-Zip\7z.exe.Exe
Size 642KB
SHA256 211cb39d76f8fddf0622669c06c1a6898ead896434bd982b85da864af81469e3
MD5 7d618862e7828e4bba117ae5df89728c
SHA1 5c3ec807d63cb009e0abf607b0ac4c2073e04073
SHA512 698bfc00f8592936f1d168b2f33acff051fc107b6fd712617f401631780222bdb37ef6c57f98752272430bec1344c51810a7f980f196aadaee41c1b0d0fd06dc
SSDEEP 12288:bCkXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:ek0Le5ji0hmxNrM
TLSH
T1F4E40815F56CB331D0F2C0B9C9DEB68AED713C811B3089CB5286976C6E276E6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXC987.tmp

Path C:\Program Files\7-Zip\RCXC987.tmp
Size 91KB
SHA256 c5646a68f2610c0881895066505436b05b7139707aeff44637a128ef0e8b922b
MD5 e0088bfebcb62daefeaa07a3466f401e
SHA1 6b504cc5e6743a9f815dba89f47fa5b358b67751
SHA512 fc70edb28f1c7b04e06b95181a06c5adbcec25635c0edf5902d1750160cf88b46915a581741b6482c14c45306557ae10b039d8d3386dc32dcafa0aea9a2662b9
SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxo8m3G5QGPML1Nb:oCSjGoLpWM6VbBgjxoxi3MhB
TLSH
T150935C5AB28DB3B6D0E159B88E0DF2E5BD793E301F19086FB1AD2F0D9A771C1190C196
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCA68.tmp

Path C:\Program Files\Java\jdk-1.8\bin\RCXCA68.tmp
Size 92KB
SHA256 9b72a2ca24c70e6a3e4090f444e7631ba361ff6fab641d82fc8dc513ceacc532
MD5 e8d51f7aa8b56e1ceb36588c8da1d9ae
SHA1 fac9cedf958f9d47f8ea2db683a8373ec83fa2ef
SHA512 7954ef22fe4f86b7122f22a0b8e8ca0b82be5cf738b4f9e045d16638b55c09377039c2d87fe7ac8dee4ea9f902d1e2fa49e4a81362d15241e310f18c68cd5347
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxQ8m3G5QGPMLYNL:wCSjGoLpWM6VbBgjxQxi3M8x
TLSH
T1E2935C5AB29CB376C0E559B88E0DF2E5BC797E301F19086BB1AE3F0D9A771C1590C186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCC8D.tmp

Path C:\Program Files\Microsoft Office 15\ClientX64\RCXCC8D.tmp
Size 156KB
SHA256 42f27a767c7e39f79df27a0fda606c74d94270cce52da300f0ebf73abe4a2dcc
MD5 5735a571fd740f8cdca07c65f0fc6c29
SHA1 d1147adaf11bc935ca540aa9b229cbc4f2804a14
SHA512 f564a35a1929bad7d9fda27dc016bf97116c75f1914e9d0c7e58c5be0919b7eac5ef385bc63d099cc31a0fa3ef77939da657aaac186549a864ec18bc64def842
SSDEEP 1536:E7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxT8m3G5QGPMLPneNz:dCSjGoLpWM6VbBgjxTxi3M7eZ
TLSH
T156F3C476B25CB776D0E199B84E1DF1E0AC6D3E201E2BCC6A715A3F0DBB761C11A0858D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCCD0.tmp

Path C:\Program Files\Mozilla Firefox\uninstall\RCXCCD0.tmp
Size 100KB
SHA256 f7dd3df8998852fd11af90a833b2843e1567e315891842f789c995678f7a4a62
MD5 69ff952f57b33a9d33b62bb303851a32
SHA1 d7384d3ec20cc1a7abc0f0feed7d379124c3bf0a
SHA512 f918393ddc30d5ee14f5f4e3040faa071463736e8c8254412f5990d18112b869b453174d263e1c4bd778be2f38d60cb1314bf522ba3dce1aa0229c08ecee15ef
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLeqkSZZZ3xNj:4CSjGoLpWM6VbBgjxOxi3M0UxJ
TLSH
T16CA35B16B68CB3B6D0F189789E0DF3E5BD357D301E69186BB2AD3F0D9A77182190C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXCCF3.tmp

Path C:\Program Files\VideoLAN\VLC\RCXCCF3.tmp
Size 92KB
SHA256 6eba46d68107e703f04d4d1091f2ac81491c6b7789a959ad14e877c0cdac93aa
MD5 f272d9eb74a0770222d73c8ea390eeb6
SHA1 22dbf425ea0d799960cb6dca077601897afff8a3
SHA512 21147e1e8a27661530335ac827f2af9caaeed0cccc9ad1308c75769b45d86ed56f0b7530d64cc1fe82fc5dc93116f11ed4855a90b7adf9b819ecd2d5139ac3b5
SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLzND:4CSjGoLpWM6VbBgjxwxi3M/p
TLSH
T1E7934B55B28CB376D0ED99BC8E0DF2E5BD657E300F29086BB19D2F0D9A7A1C1590C18E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXDEB2.tmp

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\RCXDEB2.tmp
Size 92KB
SHA256 9590b3fd023d1d3c7600a7bd7d26abdfb9fb1d0780be369d2fc85b8aae38e08f
MD5 404c51bfd0176578e583ec388fe73451
SHA1 06e33a34bd71a01277fe0d7b7a22691bf6c925a4
SHA512 5947d0b05fa8c73a8dafd539438ac940e248361c1a11f84bc0dc4b213d50f183381bec3c2c235aa8df8a3fd21ab91f41384bccfd328a04e8565b118ea009a7a1
SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLwNr:YCSjGoLpWM6VbBgjxOxi3M0R
TLSH
T176935C6AB28CB376C0E199B88E0DF2E4BD797E301E29186FB19D1F0D9E771C2590C195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a3C0A.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a3C0A.bat
Size 998B
SHA256 ec5485353a81036769f7907e27b9834f0b68c24f072f099c395d29a050527eac
MD5 271190e2dd8ef89dbf8be69f1b78b550
SHA1 5f552f67e83e6acd152aabfc76994a5e60007782
SHA512 7e09331bbd98a22675c1c18c8f47687c8581be19adf9c948b8c87da19dd24cb41c2f9b7b66b02336a4ec70bece6c5d51eeed51062dfdda37861582b89df87b7c
TLSH
T1AC11E6CB867BCE250151A04783A15CCBC161E5DA273E3710A394971F60D049EEDEE387
MD5 SHA1 SHA512 TLSH

Submit Download

2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe
Size 781KB
SHA256 2ad0dedcda48a899960f06b90b0fb9d08c83fef416f616ce359340fce4886eb4
MD5 c9f853de1e78fc0dedfed88e35f127f8
SHA1 36da03865c8337aab2f4bfac4b2195554e84a0e4
SHA512 c1ace7f8e72af4929d4e1804882889b4e6e8cc60b616680412695ef259bc2ccd61d6040d92ef31f3a8a214e55ca66c0468823074b330fd1dd32428e0a5eb71f9
SSDEEP 24576:R2zEYytjjqNSlhvpfQiIhKPtehfQwr9qySkbged:RPtjtQiIhUyQy1SkFd
TLSH
T115059E12B592C033E0A211B15578AB769DBEBD340B3195DB67C80A5D4F346C2AF36B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 93KB
SHA256 49f9ae3b272ef6b5a9bce17ab888b31528c2a9b6c6e6da279fb8272ad188c8bf
MD5 4c3d220f83584f2cfbf8d963592ff5a7
SHA1 63275e11b359fdd1af986e016b3c6dd2fff57a9c
SHA512 5f40b8a1cc9e126f736db47b9fbf4d31d0a27d6c8f07a972c345fc415d11d442b125d6037ca39e18a3e88c52e6ac53efc8cd6140a8d565b7585197aa29d45ae1
SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxI8m3G5QGPMLTN:wCSjGoLpWM6VbBgjxIxi3M/
TLSH
T114935C56B29CB376C0E259B8CE0DF2E5BD697E700E2908AFB1AD3F1D9A771C1190C185
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 842B
SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
MD5 6f4adf207ef402d9ef40c6aa52ffd245
SHA1 4b05b495619c643f02e278dede8f5b1392555a57
SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
TLSH
T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4376-18-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4708-21-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4708-896-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4708-1272-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4792-9-0x0000000000400000-0x0000000000429000-memory.dmp

Download