Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/07/2026, 04:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
- Size 874KB
- Sample260704-eqa9qsay2t
- SHA256 f5f12694e86b82785c1c83815de10b6a400f2650cf5b41af0b6be0fa12ed9791
- MD5 99ca2fc816e12a885f4c51eb49c1f6e6
- SHA1 d7302a9d4b4e0eda5cfa4d50a5ee5207f72342f7
- SHA512 5c4dcf122109718a93b61988bd4d9319bece672156387ca84c1e8d1a98cc1e24254aac62374ac5b8922be2dcf826c902bbe949b13be503ff6fceca162e82fada
- SSDEEP 24576:es2zEYytjjqNSlhvpfQiIhKPtehfQwr9qySkbged:esPtjtQiIhUyQy1SkFd
- TLSH T17B159D12B59EF332D0E200B1597CBBB69D7DBD240B3145DB67C80A5D4A345C1AE3AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Renames multiple (256) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts rundl132.exe File opened for modification C:\Windows\system32\drivers\etc\hosts 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe - Executes dropped EXE 3 IoCs
pid Process 5184 Logo1_.exe 5492 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 5048 rundl132.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\load = "C:\\Windows\\uninstall\\rundl132.exe" Logo1_.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\D: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4432.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\RCX5271.tmp Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\RCX5016.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7z.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\7zG.exe.Exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\dotnet.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Defender\MpCmdRun.exe Logo1_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe.Exe Logo1_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe.Exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe.Exe Logo1_.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\RCX52D2.tmp Logo1_.exe File created C:\Program Files\7-Zip\7zG.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\RCX43A2.tmp Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\RCX4454.tmp Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RCX4C27.tmp Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Logo1_.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe.Exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RCX4530.tmp Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe.Exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe.Exe Logo1_.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\uninstall\rundl132.exe 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Logo1_.exe 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\uninstall\rundl132.exe Logo1_.exe File created C:\Windows\RichDll.dll Logo1_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Logo1_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundl132.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe 5184 Logo1_.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 6020 wrote to memory of 3620 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 88 PID 3620 wrote to memory of 5512 3620 net.exe 90 PID 6020 wrote to memory of 1316 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 91 PID 6020 wrote to memory of 5184 6020 2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe 93 PID 5184 wrote to memory of 2132 5184 Logo1_.exe 94 PID 2132 wrote to memory of 556 2132 net.exe 96 PID 1316 wrote to memory of 5492 1316 cmd.exe 97 PID 5184 wrote to memory of 4792 5184 Logo1_.exe 100 PID 4792 wrote to memory of 1136 4792 net.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6020 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
PID:5512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3AB.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5492
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5184 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:556
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵
- System Location Discovery: System Language Discovery
PID:1136
-
-
-
-
C:\Windows\uninstall\rundl132.exeC:\Windows\uninstall\rundl132.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5048
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\RCX4FC4.tmp
- Size 94KB
- SHA256 e004fbfe49074ce0785055d648f4c50cf52c7c026ce5b0785592fa948c8afb30
- MD5 f92f2688fd7efb932bd5dc0307fb6436
- SHA1 85a6fc887035b033a7bdaffa715c0fd22e733bf0
- SHA512 d126aeb5ebc6710c8bfb6b3ef165a72db5da5f88a9dd4ebc8864271fdf94d751875f452d097d98bf0c0d866a53b58333b69ed73db94fe3ccc4b652b8cb754c94
- SSDEEP 1536:Z7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLiND:ACSjGoLpWM6VbBgjxwxi3Mep
- TLSH T121932A56B28CB3B6D0E199BC8E0FF2E5AD757E201E2D08AFB1992F0DDE761C1590C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe.Exe
- Size 5.8MB
- SHA256 ec5b6178b677a9400603c35e964c3205b1af07393a7aa2169acb2739838b0047
- MD5 c64f33af84f480dd794894425e997018
- SHA1 b4eac37455ba8d5b9fcf89320101bfb73fd92647
- SHA512 5647f634630a2b2148e01f2ffee8c711966501ae290bd31a2fe647bacaa5796b57658a782d94548a1bd6861712c147bed79b73fab7ca14aa0d1c90536a62a24e
- SSDEEP 98304:2og5HQ+hDHQTW6Af4fF7KkOuYO6IgF+IAMk/JexMXP8iuHG9XXYXQz7ws:2og1P9fIlOuz6IgF+I3m2MXP6HG8Qzb
- TLSH T13A567B23A4E46130E5F332756D2CA7395D327FA29F3145CB86906C946FB82D3293936B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\RCX5312.tmp
- Size 103KB
- SHA256 a307651c18988c1dd13fb36f9eab06b6c31cd36fd22cc604cb137ca569e4b419
- MD5 038c28febe3d553f6419e61b86835a6b
- SHA1 e0f12c7e005e14e9540a3524d923ad59fa1acaa3
- SHA512 2adc5f2926c5bfec06f5413577026fa30c2709ac9596e31203b7c987ad7f48a75c9d80245b9f265640450bda01f62b8bc2d938e608853e54c964881074f7544e
- SSDEEP 1536:R7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxp8m3G5QGPMLM1XkSPsULMHi4NQ:YCSjGoLpWM6VbBgjxpxi3MAdtPlLqtu
- TLSH T163A37C1AB28DB376D0E199BC8E0DF2E4BD397D301F19186FB29E1F0D9A765C2190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX5165.tmp
- Size 118KB
- SHA256 3dc7ac166d364a3bafc320bb1231d42483dc374f512b5585e45bd8de0afc7afe
- MD5 4b1c50c33032935a7eebdc2704588a4c
- SHA1 d557ad3c22defdbc71ba97e0ec03ff17500f8a09
- SHA512 1f48f386e44b787f8266704a86d061046cef51c85ae51eac769f72fa3579a51bf2cc8b13fe08943b54aaff6a0c67e0e3dfcc5a7a8e0bde44af4308109db93b7a
- SSDEEP 1536:M7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxz8m3G5QGPMLx4GZjzQwK5WW7VCa:FCSjGoLpWM6VbBgjxzxi3Mje5BV0SH
- TLSH T19DC3AE5AB28CB377C0E199B88E0DF2E4BD797E301E29086FB5991F0DCA7B5C1590C192
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe.Exe
- Size 642KB
- SHA256 211cb39d76f8fddf0622669c06c1a6898ead896434bd982b85da864af81469e3
- MD5 7d618862e7828e4bba117ae5df89728c
- SHA1 5c3ec807d63cb009e0abf607b0ac4c2073e04073
- SHA512 698bfc00f8592936f1d168b2f33acff051fc107b6fd712617f401631780222bdb37ef6c57f98752272430bec1344c51810a7f980f196aadaee41c1b0d0fd06dc
- SSDEEP 12288:bCkXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:ek0Le5ji0hmxNrM
- TLSH T1F4E40815F56CB331D0F2C0B9C9DEB68AED713C811B3089CB5286976C6E276E6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\RCX4176.tmp
- Size 91KB
- SHA256 c5646a68f2610c0881895066505436b05b7139707aeff44637a128ef0e8b922b
- MD5 e0088bfebcb62daefeaa07a3466f401e
- SHA1 6b504cc5e6743a9f815dba89f47fa5b358b67751
- SHA512 fc70edb28f1c7b04e06b95181a06c5adbcec25635c0edf5902d1750160cf88b46915a581741b6482c14c45306557ae10b039d8d3386dc32dcafa0aea9a2662b9
- SSDEEP 1536:B7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxo8m3G5QGPML1Nb:oCSjGoLpWM6VbBgjxoxi3MhB
- TLSH T150935C5AB28DB3B6D0E159B88E0DF2E5BD793E301F19086FB1AD2F0D9A771C1190C196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\RCX4304.tmp
- Size 92KB
- SHA256 9b72a2ca24c70e6a3e4090f444e7631ba361ff6fab641d82fc8dc513ceacc532
- MD5 e8d51f7aa8b56e1ceb36588c8da1d9ae
- SHA1 fac9cedf958f9d47f8ea2db683a8373ec83fa2ef
- SHA512 7954ef22fe4f86b7122f22a0b8e8ca0b82be5cf738b4f9e045d16638b55c09377039c2d87fe7ac8dee4ea9f902d1e2fa49e4a81362d15241e310f18c68cd5347
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxQ8m3G5QGPMLYNL:wCSjGoLpWM6VbBgjxQxi3M8x
- TLSH T1E2935C5AB29CB376C0E559B88E0DF2E5BC797E301F19086BB1AE3F0D9A771C1590C186
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\RCX4641.tmp
- Size 156KB
- SHA256 42f27a767c7e39f79df27a0fda606c74d94270cce52da300f0ebf73abe4a2dcc
- MD5 5735a571fd740f8cdca07c65f0fc6c29
- SHA1 d1147adaf11bc935ca540aa9b229cbc4f2804a14
- SHA512 f564a35a1929bad7d9fda27dc016bf97116c75f1914e9d0c7e58c5be0919b7eac5ef385bc63d099cc31a0fa3ef77939da657aaac186549a864ec18bc64def842
- SSDEEP 1536:E7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxT8m3G5QGPMLPneNz:dCSjGoLpWM6VbBgjxTxi3M7eZ
- TLSH T156F3C476B25CB776D0E199B84E1DF1E0AC6D3E201E2BCC6A715A3F0DBB761C11A0858D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\RCX46B3.tmp
- Size 100KB
- SHA256 f7dd3df8998852fd11af90a833b2843e1567e315891842f789c995678f7a4a62
- MD5 69ff952f57b33a9d33b62bb303851a32
- SHA1 d7384d3ec20cc1a7abc0f0feed7d379124c3bf0a
- SHA512 f918393ddc30d5ee14f5f4e3040faa071463736e8c8254412f5990d18112b869b453174d263e1c4bd778be2f38d60cb1314bf522ba3dce1aa0229c08ecee15ef
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxO8m3G5QGPMLeqkSZZZ3xNj:4CSjGoLpWM6VbBgjxOxi3M0UxJ
- TLSH T16CA35B16B68CB3B6D0F189789E0DF3E5BD357D301E69186BB2AD3F0D9A77182190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VideoLAN\VLC\RCX4724.tmp
- Size 92KB
- SHA256 6eba46d68107e703f04d4d1091f2ac81491c6b7789a959ad14e877c0cdac93aa
- MD5 f272d9eb74a0770222d73c8ea390eeb6
- SHA1 22dbf425ea0d799960cb6dca077601897afff8a3
- SHA512 21147e1e8a27661530335ac827f2af9caaeed0cccc9ad1308c75769b45d86ed56f0b7530d64cc1fe82fc5dc93116f11ed4855a90b7adf9b819ecd2d5139ac3b5
- SSDEEP 1536:x7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxw8m3G5QGPMLzND:4CSjGoLpWM6VbBgjxwxi3M/p
- TLSH T1E7934B55B28CB376D0ED99BC8E0DF2E5BD657E300F29086BB19D2F0D9A7A1C1590C18E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.Exe
- Size 545KB
- SHA256 cf7c67a799dba0c6928ae1fd66f497600805ab8ad641650c5165fc440833e9fd
- MD5 89160d63ca8e9e0ac465aef7b0787bfe
- SHA1 1cc265a0d0e6f4eb390fa236171ce818f37b0fd0
- SHA512 ee2456a7d0119bed5492b813f9b355337d4c2bfb0347475ee406ba9a075bb486f325eef20f0c99702c823815d1357bff826a1ee99d741cb75c814dfe3f329edc
- SSDEEP 6144:uXq1gGi3u78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:JCo85bM3npxYfj63hgD1ZiL
- TLSH T112C4D50277EDB335F2F31B31AE7DB2515E7ABC619D35860E23841A0D49B0980EA75B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$$aB3AB.bat
- Size 998B
- SHA256 bb3e7f450ca2c2ac36560b007c1e85d65a036cced653fd194ea240ccb35532ac
- MD5 71db089d0fc42427a4ebb387d5a8c78e
- SHA1 7841edf7d45f8c75861b583f987a0c6305fe367d
- SHA512 3f29cfd7b7a919e0e27d53cfb2e4dbd8f5fed0396fa91fe6ee4c754a32d77402b1667da18dae2dad80b1d8fa26906e4a4bf4b4201238a6ac851833a4f544e7e0
- TLSH T1FD11E6CB867BCF250151A04783A16CCBC161E5DA272E3710A394971F60E049FEDEE387
- MD5 SHA1 SHA512 TLSH
2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-04_99ca2fc816e12a885f4c51eb49c1f6e6_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_smoke-loader.exe.exe
- Size 781KB
- SHA256 2ad0dedcda48a899960f06b90b0fb9d08c83fef416f616ce359340fce4886eb4
- MD5 c9f853de1e78fc0dedfed88e35f127f8
- SHA1 36da03865c8337aab2f4bfac4b2195554e84a0e4
- SHA512 c1ace7f8e72af4929d4e1804882889b4e6e8cc60b616680412695ef259bc2ccd61d6040d92ef31f3a8a214e55ca66c0468823074b330fd1dd32428e0a5eb71f9
- SSDEEP 24576:R2zEYytjjqNSlhvpfQiIhKPtehfQwr9qySkbged:RPtjtQiIhUyQy1SkFd
- TLSH T115059E12B592C033E0A211B15578AB769DBEBD340B3195DB67C80A5D4F346C2AF36B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Logo1_.exe
- Size 93KB
- SHA256 49f9ae3b272ef6b5a9bce17ab888b31528c2a9b6c6e6da279fb8272ad188c8bf
- MD5 4c3d220f83584f2cfbf8d963592ff5a7
- SHA1 63275e11b359fdd1af986e016b3c6dd2fff57a9c
- SHA512 5f40b8a1cc9e126f736db47b9fbf4d31d0a27d6c8f07a972c345fc415d11d442b125d6037ca39e18a3e88c52e6ac53efc8cd6140a8d565b7585197aa29d45ae1
- SSDEEP 1536:p7qnkAQtSaoGo5n4iLG0/WM6TJNHSaYqeygjxI8m3G5QGPMLTN:wCSjGoLpWM6VbBgjxIxi3M/
- TLSH T114935C56B29CB376C0E259B8CE0DF2E5BD697E700E2908AFB1AD3F1D9A771C1190C185
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 842B
- SHA256 d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
- MD5 6f4adf207ef402d9ef40c6aa52ffd245
- SHA1 4b05b495619c643f02e278dede8f5b1392555a57
- SHA512 a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
- TLSH T14201FD2D0BDEF8AC077285D21A4DF44DB26A55F0627B0E89385C820D37A776D8726A4A
- MD5 SHA1 SHA512 TLSH