Overview

overview

6

Static

static

1

2026-07-05...os.exe

windows10-2004-x64

6

2026-07-05...os.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    05/07/2026, 06:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe
  • Size 2.6MB
  • Sample260705-gr2t7aas8x
  • SHA256 767f7486a3bc26252f58f770030cc721702715f00abf30c9138eadab2cc89dd4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe -sendDump="C:\Users\Admin\AppData\Local\Temp/KAVINST.21.3.12.434_07.05_07.03_4732.SETUP.full.dmp"
      2⤵
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4888

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        check_new_version.html
        • Path C:\Users\Admin\AppData\Local\Temp\321CD2CE-7837-11F1-AA2C-7A3BE15C66E4\check_new_version.html
        • Size 1KB
        • SHA256 b80ae17471313fd379c1eb9cf7b228c4df02e3392c11401b1f5d74156fe91b85
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install_error_send_logs_page.html
        • Path C:\Users\Admin\AppData\Local\Temp\34AC7936-7837-11F1-AA2C-7A3BE15C66E4\install_error_send_logs_page.html
        • Size 2KB
        • SHA256 dc941f8c29345b64c1f8837606be8787783f5fea6f562494a29b984356447d8c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jquery-1.12.4.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\34AC7936-7837-11F1-AA2C-7A3BE15C66E4\jquery-1.12.4.min.js
        • Size 94KB
        • SHA256 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jquery.custom_select.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\34AC7936-7837-11F1-AA2C-7A3BE15C66E4\jquery.custom_select.min.js
        • Size 5KB
        • SHA256 dd678d32073078552e0e2c35eed78f16cc8d6e8662d4734518561a1b183f775c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-print.css
        • Path C:\Users\Admin\AppData\Local\Temp\34AC7936-7837-11F1-AA2C-7A3BE15C66E4\kis-print.css
        • Size 306B
        • SHA256 2481b34b48fd96b194405da621e8e5f19142dcb55744f9c9a93591705cb697fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script-lte-ie8.js
        • Path C:\Users\Admin\AppData\Local\Temp\34AC7936-7837-11F1-AA2C-7A3BE15C66E4\kis-script-lte-ie8.js
        • Size 1KB
        • SHA256 33e84b33ff911257e3a6a303c08a2cc178827dadb7dfd7c951e096866e02ad5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script.js
        • Path C:\Users\Admin\AppData\Local\Temp\34AC7936-7837-11F1-AA2C-7A3BE15C66E4\kis-script.js
        • Size 306B
        • SHA256 97e5f342227ea23c27c1b660f111847fcdd9d7b23c1d248c733a36f983fd7f04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-style.css
        • Path C:\Users\Admin\AppData\Local\Temp\34AC7936-7837-11F1-AA2C-7A3BE15C66E4\kis-style.css
        • Size 29KB
        • SHA256 f9963b403e053f6bfa7c87cad3c10dd55cf1f94fefe00c6380921440e28b48d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.dll
        • Path C:\Users\Admin\AppData\Local\Temp\DC2DC12373871F11AAC2A7B31EC5664E\setup.dll
        • Size 5.1MB
        • SHA256 fbbf6991bacf4ad5e6a86397510eb24129e10c403b9d03cfee7119138cc343d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4732-2-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download

        memory/4732-0-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download

        memory/4732-1-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download

        memory/4888-37-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download

        memory/4888-38-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download

        memory/4888-39-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download