a8d40391d7ee98d784fe795d1706ed0529389b7d023ec9987fda0bd68b00f026

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_4bdc6935b8375ba4ecee281c2b115051_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader.exe
Size 1.1MB
Sample260711-e9wpsadz7t
SHA256 a8d40391d7ee98d784fe795d1706ed0529389b7d023ec9987fda0bd68b00f026
MD5 4bdc6935b8375ba4ecee281c2b115051
SHA1 866c39286fe408c6b94c852db7f25224fa5ef70c
SHA512 c6bad1c65f6905eb99ddd07e522f932e88ffd8064c98700de0e49dc23bc59d807c287972bb06f145dd874f32266e8536f6017acdc08cbe939944662364990c80
SSDEEP 24576:QzOIOdpPLGDI1r8wbTQT2u3h0lhSMXll7oparz9t1:QKjdpPyDIdbTBBprzP1
TLSH
T1A045BF11BD9183B6E05206B016BECF79AF3A7C31472146CBA3A076A58CB16D16F33D5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3604	dotnet-runtime-10.0.5-win-x86.exe
4428	wixstdba.exe
4784	dotnet-runtime-10.0.5-win-x86.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519} = "\"C:\\ProgramData\\Package Cache\\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\\dotnet-runtime-10.0.5-win-x86.exe\" /burn.runonce"	dotnet-runtime-10.0.5-win-x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dotnet\swidtag\Microsoft .NET Runtime - 10.0.5 (x86).swidtag	dotnet-runtime-10.0.5-win-x86.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-10.0.5-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-10.0.5-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_4bdc6935b8375ba4ecee281c2b115051_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dotnet-runtime-10.0.5-win-x86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wixstdba.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3604	dotnet-runtime-10.0.5-win-x86.exe
4784	dotnet-runtime-10.0.5-win-x86.exe
4780	dotnet-runtime-10.0.5-win-x86.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\ = "{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}"	dotnet-runtime-10.0.5-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\DisplayName = "Microsoft .NET Runtime - 10.0.5 (x86)"	dotnet-runtime-10.0.5-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\Dependents	dotnet-runtime-10.0.5-win-x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\Dependents\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}	dotnet-runtime-10.0.5-win-x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}	dotnet-runtime-10.0.5-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\Version = "10.0.5.35903"	dotnet-runtime-10.0.5-win-x86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\Dependents\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}	dotnet-runtime-10.0.5-win-x86.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\Dependents	dotnet-runtime-10.0.5-win-x86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}	dotnet-runtime-10.0.5-win-x86.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3604	2712	2026-07-11_4bdc6935b8375ba4ecee281c2b115051_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader.exe	87
PID 3604 wrote to memory of 4428	3604	dotnet-runtime-10.0.5-win-x86.exe	88
PID 3604 wrote to memory of 4784	3604	dotnet-runtime-10.0.5-win-x86.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-11_4bdc6935b8375ba4ecee281c2b115051_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_4bdc6935b8375ba4ecee281c2b115051_amadey_blankgrabber_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\CoronaLauncher\Temp\dotnet-runtime-10.0.5-win-x86.exe
  "C:\Users\Admin\AppData\Local\Temp\CoronaLauncher\Temp\dotnet-runtime-10.0.5-win-x86.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.ba\wixstdba.exe
    "C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{5DDC04C3-751F-457F-9D75-808E409975B2} {A03E4C3F-9AA8-4EED-A3BE-ED762345D161}
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4428
- - C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.be\dotnet-runtime-10.0.5-win-x86.exe
    "C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.be\dotnet-runtime-10.0.5-win-x86.exe" -q -burn.elevated BurnPipe.{4266C015-7F46-431C-86CF-BE5B38E31CE2} {7210F7D8-A544-42E3-940A-2B8D1295A931} 3604
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    - Modifies registry class
    PID:4784

C:\ProgramData\Package Cache\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\dotnet-runtime-10.0.5-win-x86.exe
"C:\ProgramData\Package Cache\{B7C7156A-3DCD-4D97-9DB5-16F9554A8519}\dotnet-runtime-10.0.5-win-x86.exe" /burn.runonce
1⤵
- System Location Discovery: System Language Discovery
- System Time Discovery
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dotnet-runtime-10.0.5-win-x86.exe

Path C:\Users\Admin\AppData\Local\Temp\CoronaLauncher\Temp\dotnet-runtime-10.0.5-win-x86.exe
Size 27.0MB
SHA256 dbd7b9b37d02ecd915c91b55984cf108fa73b8546fadab6bfe26b7fcaa6153d5
MD5 7f5beda4c0402a8941ed80ec6a2bdf75
SHA1 fa8d8c38cebde5f74f6a425836727539177c0143
SHA512 30dd221ec758f262873b4a050a3f974a5fd128907c016a8a364d3ff8df447b62a97f5b02370c90611192b4e64d5b8eb1948f488a8af86ab6e68c256e5ae9000b
SSDEEP 393216:fsadP6s5UQ0rxF9IDkvv+j4ha2o42efCnSSxZzyWcuxgomBo88p5MHbxiskuOKdE:bd75X0rxcAvi2a2NNfCnS4ZtPE8h
TLSH
T1FE573372B122282BE3F50573B815D620BF2CDB08271985AAC6C4D85D794D6F66FFB10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet_runtime_10.0.5_win_x86.msi

Path C:\Users\Admin\AppData\Local\Temp\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\dotnet_runtime_10.0.5_win_x86.msi
Size 26.0MB
SHA256 9c727b9dd818b234bb2b467fe3d9966890824219fa9cd31a3a738675f4a236c8
MD5 bcef8a3e9dbeceefd3ab3dd7206eff5c
SHA1 4995d9a440b7dc071d661c2fc50427c5b027a598
SHA512 a34943ed89e4bc194177ae82408693e562175851676ba0c7cf4dc608f4f9745d53df6c11a8b51378f374aa5593f790b0b3f6c0fa7c46418bed5775fb3f0149eb
SSDEEP 393216:uUE35EdeRF/xcN7gap15FxY79C5M1Tkam9yM7CkBb1HmYZl8x8QLJ6uk4tt:CpRF/xcdgY5ChC54TkamE2xZP
TLSH
T1BD5733677D128935D2AA0C72907ED7A50F3DAC04270089AF53A4B85EFCF41D29BF66C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.ba\1033\thm.wxl
Size 6KB
SHA256 e36d45456e8b5ccec5f482b19f39188fbc166ca38d33f3a225661ae322315219
MD5 84522b04814debdfb47599ecbc0bc095
SHA1 d7defafd79a77c50a4781ae27a2169f85e179049
SHA512 1357f53f2b74386bbaef85929003fa5d97b48b90cd044c8aca204668d2edfc27a4633563e2539651ed31d0fe6b280725bbc1a13d0c7020a060265c6a8b85b4b9
SSDEEP 96:hibTxM1+XSlc0rzAgHtYQstYCpDwZQpCeYPqHQJM9U:IdMtEatYQstYCE1i9U
TLSH
T1CAD1E06F68CFDFE06A731B45B6B358892519C2DA132B1CF4F86E444B87675016373A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.ba\BootstrapperApplicationData.xml
Size 6KB
SHA256 e6724ec95ac6f69bb5c6585273b6b9bc0ff76e5880fe74df77f5b7bcb00426a4
MD5 3bb5528580dfcd3982843f125bd06a2d
SHA1 ddeea6ecbbfdb7012974d344827995a1aabc085d
SHA512 3a6ee928ca1c7e7330c9c6b52bcba2d8148095052619041b23a85416132f8afc338f253f93ca32189d137c69fc55c45066266f36f42adb92dd6220722a8d44d3
SSDEEP 96:2Lbwcn6Xzz0wEyckn6vSsD20w8ycyjUfn6zGYY0woyc5kWKrP6W6rP2QWKrsV2VA:2Ln0E0HsDMpi4JoxqD+sA
TLSH
T190D134153BFD0318F0F34F84EAF555066A35BD91AE38C96D00621E0E4973A81D9A2FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetLogo_256x.png

Path C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.ba\DotNetLogo_256x.png
Size 2KB
SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
MD5 39aa52615723b782c92dec710caaec7f
SHA1 760b49e256a7979fe50a56a2b1be3688a474b886
SHA512 89d1baa3820154667747b25e9e2fd321bfb2ec71dc309915b0a28dacdc80822a4943b639ebb37c37bd2559d5a4306d2096119cd970c84a0d331f6c68b0456dc9
TLSH
T1534195CF1BFD78D7E6E557918E1A8DD232738483B4B3A42CCE7B10B8274A5642B87940
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.ico

Path C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.ba\dotnet.ico
Size 44KB
SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
MD5 b8096652d9ec286709a2c863b244b110
SHA1 b3b7f0f4d608fad7cb59ba499d4d17c2b873a7af
SHA512 492a5aa83220bb77c178b7c5b50bf44968c0427e9e45bb97a33df14d7fb4c667ca7adde0ebb3874c7b6011057b01144e4e6651fbad62c6bcf5e0b93586c4bc7a
SSDEEP 96:r+gfbzo+wHK9NbwOY4tIWQeVlV1W9+H+guapUjFamINUItzf1dBNaIZ:ro5HuNcH4tIzeVlV1WEOFDgUWzf1PIm
TLSH
T1E913EF6DE68547C1C10C2032DB4AC792B5233C72E4DAE0C4F9D4FA7E177906965C6E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.xml

Path C:\Windows\TEMP\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.ba\thm.xml
Size 11KB
SHA256 82f5f0e8a5f851af979675b7f726cc1948e0dece2e7def0f588c72dd04fdace9
MD5 934bd6d6f0607fe1525597f9ec8f569f
SHA1 33a295a3156d94a313e2cd4e9423873d5716460f
SHA512 a5a60337ba8bf43d16092df6a0d1ee97e4fa073365424a2bb1f852e97d7d359e06a571aead7d75e84008296b747483519eff2936c2ab8158abcadad137beb219
SSDEEP 96:ygvPkoeWEH3IWTajJvUa65mFaJbuB8pR5asHYPgpwe+UIJLg1gEp+6F5pQnxF:dvoWydmqvyyj5E
TLSH
T14232106951DCB811C132D712BB9331D2FF12BDA6C6C45918B58E256B2FF362068B739C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.exe

Path C:\Windows\Temp\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.ba\wixstdba.exe
Size 431KB
SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
MD5 0e88ffd2e737ac9b9a4241616838bc23
SHA1 3c8beb465d20bcef0cd6ceca9c60286d1d15cebd
SHA512 169b9e08518834c9bc5adfe4ab7b79e07685b72f30ede1c1a386229668bde8c15da378e1274e4013ad7b84d6f7a5acc64ef0806e3b8a66322861efaa7e26b620
SSDEEP 6144:X9vfS1NP+c3ytxmg4Stlqe3B9m2LSLTwGw7C3ZLaov5xZvSdF:X9v+GIyugllqe3wwGfX5/SdF
TLSH
T129943B3165F04037C6F90572AE14FA31BF69F208231095EBA3C0DD293968AE5BBB7657
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-runtime-10.0.5-win-x86.exe

Path C:\Windows\Temp\{0BCDD6D7-F9BA-4BB5-B8B8-E5CD578EFA14}\.be\dotnet-runtime-10.0.5-win-x86.exe
Size 977KB
SHA256 a45fac6a58c4c971491043d8af4a1035542446a810c171d1beadc8a1d504aae8
MD5 9a2e370e0571294e77318a5b36e1e118
SHA1 6998fe5770523908ae5f83356d518ade0125bb6c
SHA512 20bfacb4c1dfd598244df031561e3f77c1033010ff15645a15756dcf829818a94adbd7f07756352602d8396f102ab49f4cd0e7206dd817917c36aa8b06ebbfac
SSDEEP 12288:tVGWl6qCmyZeU6lqlDjC+fScn6X8GwMgJE8K96ADmfS8pt9A1GF:tVGWl6qCmyt6UdmcpMzvoylU
TLSH
T183257D31A166242BD6F50973F914D2307E2CD7082B5C99B6C6C0D90D39689FA6FFB24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4780-57-0x0000000000530000-0x00000000005F6000-memory.dmp

Download

memory/4784-58-0x0000000000AF0000-0x0000000000BB6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads