Overview

overview

6

Static

static

1

2026-07-05...os.exe

windows10-2004-x64

6

2026-07-05...os.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 06:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe
  • Size 2.6MB
  • Sample260705-gr2t7aas8x
  • SHA256 767f7486a3bc26252f58f770030cc721702715f00abf30c9138eadab2cc89dd4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Users\Admin\AppData\Local\Temp\2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-05_d0124bf7491afded1017baab23450258_amadey_elex_hijackloader_luca-stealer_lynx_medusalocker_njrat_remcos.exe -sendDump="C:\Users\Admin\AppData\Local\Temp/KAVINST.21.3.12.434_07.05_07.03_3540.SETUP.full.dmp"
      2⤵
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:832

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        setup.dll
        • Path C:\Users\Admin\AppData\Local\Temp\2FBBEF2373871F1109506F62BD509DEF\setup.dll
        • Size 5.1MB
        • SHA256 fbbf6991bacf4ad5e6a86397510eb24129e10c403b9d03cfee7119138cc343d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        check_new_version.html
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\check_new_version.html
        • Size 1KB
        • SHA256 b80ae17471313fd379c1eb9cf7b228c4df02e3392c11401b1f5d74156fe91b85
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jquery-1.12.4.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\jquery-1.12.4.min.js
        • Size 94KB
        • SHA256 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jquery.custom_select.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\jquery.custom_select.min.js
        • Size 5KB
        • SHA256 dd678d32073078552e0e2c35eed78f16cc8d6e8662d4734518561a1b183f775c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-loading.gif
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\kis-loading.gif
        • Size 10KB
        • SHA256 f056164cf99799234c90e2318e90ab5d83d0fd855118224286ff0680ee455734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-logo.png
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\kis-logo.png
        • Size 4KB
        • SHA256 681a96b96b5e0425fc74be929d29164528bf0bc0a84ac97952c011e407e23d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-print.css
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\kis-print.css
        • Size 306B
        • SHA256 2481b34b48fd96b194405da621e8e5f19142dcb55744f9c9a93591705cb697fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script-lte-ie8.js
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\kis-script-lte-ie8.js
        • Size 1KB
        • SHA256 33e84b33ff911257e3a6a303c08a2cc178827dadb7dfd7c951e096866e02ad5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script.js
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\kis-script.js
        • Size 306B
        • SHA256 97e5f342227ea23c27c1b660f111847fcdd9d7b23c1d248c733a36f983fd7f04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-style.css
        • Path C:\Users\Admin\AppData\Local\Temp\32FEBBF3-7837-11F1-9005-F626DB05D9FE\kis-style.css
        • Size 29KB
        • SHA256 f9963b403e053f6bfa7c87cad3c10dd55cf1f94fefe00c6380921440e28b48d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install_error_send_logs_page.html
        • Path C:\Users\Admin\AppData\Local\Temp\361D1ADA-7837-11F1-9005-F626DB05D9FE\install_error_send_logs_page.html
        • Size 2KB
        • SHA256 dc941f8c29345b64c1f8837606be8787783f5fea6f562494a29b984356447d8c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-error.png
        • Path C:\Users\Admin\AppData\Local\Temp\361D1ADA-7837-11F1-9005-F626DB05D9FE\kis-error.png
        • Size 275B
        • SHA256 a941af55adff84f31549a72042eeebdd297f1de54a5d346e1667e11a2372dea4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/832-68-0x00000000772D0000-0x00000000772E0000-memory.dmp
        Download

        memory/832-67-0x00000000772D0000-0x00000000772E0000-memory.dmp
        Download

        memory/832-66-0x00000000772D0000-0x00000000772E0000-memory.dmp
        Download

        memory/3540-1-0x00000000772E0000-0x00000000772F0000-memory.dmp
        Download

        memory/3540-2-0x00000000772E0000-0x00000000772F0000-memory.dmp
        Download

        memory/3540-0-0x00000000772E0000-0x00000000772F0000-memory.dmp
        Download