Overview

overview

6

Static

static

1

2026-07-14...er.exe

windows10-2004-x64

3

2026-07-14...er.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 22:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-14_52bcfc9974713b1564fb5c8d45c3303f_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
  • Size 316KB
  • Sample260714-17z53sgz21
  • SHA256 322a544a7ed38290a22454e80bc6a09c48d162aa36e06aafcb7125194f93b77c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_52bcfc9974713b1564fb5c8d45c3303f_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_52bcfc9974713b1564fb5c8d45c3303f_amadey_cobalt-strike_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5408
    • C:\Users\Admin\AppData\Local\Temp\OF0.tmp\OutlookFreewareSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\OF0.tmp\OutlookFreewareSetup.exe"
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4620
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding FB19B1E8B6C6B0E8F25B8BE160B590D8 C
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:3228

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OutlookFreewareSetup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\OF0.tmp\OutlookFreewareSetup.exe
        • Size 4.2MB
        • SHA256 ea421c3ea7422ed10dafc497f1ad39c74d7da344461b94527e7a462cf55adca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Setup.msi
        • Path C:\Users\Admin\AppData\Local\Temp\RJ0.tmp\Setup.msi
        • Size 1.5MB
        • SHA256 ec016782290006f394b69417862429c6cb896878f3ed6ff5c896f6ceea590d66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download