Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 02:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_a51011e72079e0c44b825cc135e2a3e4_amadey_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-17_a51011e72079e0c44b825cc135e2a3e4_amadey_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos_smoke-loader.exe
- Size 9.2MB
- Sample260718-c5l9fahs41
- SHA256 68c9608698cb2d93ee1d3bc2b0d8aae515d33478f4e486e9b8bd777343cf561a
- MD5 a51011e72079e0c44b825cc135e2a3e4
- SHA1 e4f9b2d501fefb0b22f57419233782652548c331
- SHA512 89e76b814b5f51350177aabe471b25308d5b01815f08bffdf613e4ac69d01d14c2bc5bf00785bdffa12b4e748020c39ef54d44df045d7595cb638e52925a090c
- SSDEEP 196608:QMZOTCTMiwp5zFKhlF1Zmtgq61m1yqI0Weg4lr1dmB73/xw:2CTMRKhlx3bsrgw1k7vxw
- TLSH T1BDA601C0B365F818EB55067008397AF4966626303321D9EEBE8F7AD219583C5ADF1E37
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3320 akelpad_setup.exe 1124 AkelPad.exe 1860 AkelPad.exe - Loads dropped DLL 3 IoCs
pid Process 3320 akelpad_setup.exe 3320 akelpad_setup.exe 3320 akelpad_setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\AkelPad\scripts.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Exit.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Hotkeys.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\LineBoard.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\xml.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\InsertFile.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\BATCH\batch.bat akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\HTML\html5.html akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Exit-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Fonts-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Macros-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Stats-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Finnish.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Greek.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\SaveFile.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Exit-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Explorer-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Format-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\QSearch-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Sessions-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\German.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Clipboard.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Format.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SaveFile-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ToolBar-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sessions.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\coder.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\inno.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\lua.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\pascal.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\php.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ContextMenu-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\MinimizeToTray-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Polish.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Ukrainian.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Stats.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\bat.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\python.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\rc.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\AkelHelp-Eng.htm akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Format-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Sounds-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Stats-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\English.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\nsis.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\SpellCheck.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds\Return.wav akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelPad.exe akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Templates-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Czech.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Japanese.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\RecentFiles.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\Calculator.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\ColumnCounter.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\SearchReplace.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\AkelHistory-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Fonts.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\asm.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\Include\ShowMenu.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\ASP\ASP_VBS.asp akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\C-Language\winhello.c akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\XML\general.xml akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ToolBar-Rus.txt akelpad_setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AkelPad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_a51011e72079e0c44b825cc135e2a3e4_amadey_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language akelpad_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AkelPad.exe - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000e00000001c492-4.dat nsis_installer_1 behavioral2/files/0x000e00000001c492-4.dat nsis_installer_2 behavioral2/files/0x000c00000001c59e-433.dat nsis_installer_1 behavioral2/files/0x000c00000001c59e-433.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2588 wrote to memory of 3320 2588 2026-07-17_a51011e72079e0c44b825cc135e2a3e4_amadey_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos_smoke-loader.exe 89 PID 3320 wrote to memory of 1124 3320 akelpad_setup.exe 90 PID 3320 wrote to memory of 1860 3320 akelpad_setup.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_a51011e72079e0c44b825cc135e2a3e4_amadey_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_a51011e72079e0c44b825cc135e2a3e4_amadey_elex_luca-stealer_mespinoza_metamorfo_njrat_remcos_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\7zSC1A825C9\akelpad_setup.exe.\akelpad_setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files (x86)\AkelPad\AkelPad.exe"C:\Program Files (x86)\AkelPad\AkelPad.exe" /reassoc /quit3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1124
-
-
C:\Program Files (x86)\AkelPad\AkelPad.exe"C:\Program Files (x86)\AkelPad\AkelPad.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\AkelPad\AkelFiles\Uninstall.exe
- Size 54KB
- SHA256 c9ab37c4f1ad6511ba7a2d72485b419af366c317fb4c00d2b7c623dc0fe90e32
- MD5 eaa245e39f16098675e81fbab307aa4c
- SHA1 2e66f071b8a95488d34d7e0da0f49b4ac7c073e2
- SHA512 0f56ab88530752132b57688196b97a70788a5a7af44fb8fdb32fe271f6a6e196bdeeec683e763c3ff0949f9cb4ea74e1d3397c19f5ed04bc36003059d31bbadf
- SSDEEP 768:+1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJ0t3DNDmjS2vqEFdmNbJmBFeWWs:8QpQ5EP0ijnRTXJ05NDmjJCJmBwPs
- TLSH T13D43BF1379D3CCA7F24A063126BBD3B6E2F5F34522710647DB681FBEE9141839915392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\AkelPad\AkelPad.exe
- Size 410KB
- SHA256 bcf96667f2b87623045580c7ab9ca93c19189fec9841fb07af3f54524fccafe8
- MD5 8f14b29e61aa73b27ac8389e8a02a0d8
- SHA1 078675252356a5bb7d6dc6e294e7ee6a16fd71d2
- SHA512 8fe990ccc7ea369112b2bd8b3f19ee24d297dbb5f9d7e2c79fd89fdf89f8cd5741f63933d95dee31acc6e2492aac61109311b030743068d574952c984841d5e7
- SSDEEP 12288:eP9HkdNJ0bFCuN1hNpoy6AUjqN4Tid1oNkDfibxOH:eP9HkHJ0bFLN1hNWkUjqN4TidaNymO
- TLSH T1E9948E52F1F2C032D4B3C9702D9B57A56FBAFE1018358D47A3D439CDA271692EA2631E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zSC1A825C9\akelpad_setup.exe
- Size 1.2MB
- SHA256 ad63ea4048d68721701a3c0d2d9041a158e90789c7fc24526380607aad136aca
- MD5 0ac63da17f7003c1ad26906d0a72f4fd
- SHA1 339d723c3d19fd334a508b5148207bbdab0cfd5f
- SHA512 cc3633bd935774a741609bebe6d63368a273686f7ae704536d867e741559d5676dce92a6d826eafdc8441554326966d62962ced4e8809ee9a519a5c43cf6e3f3
- SSDEEP 24576:sqIJQXd7CUwcof6p2n/hhlGXZTIhnZNK335Yya78/d:AA7fofZnNSMCpfd
- TLSH T1E645334280E6C8BBCA95503116A7AB7BEBBCDF2647AB070B5752BF76F8743010681747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa9D80.tmp\InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa9D80.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa9D80.tmp\ioSpecial.ini
- Size 645B
- SHA256 b3114bef24873f876c30ab87ffa1d5c45d3d5f77377f3ae8a05a56319a3ae5cb
- MD5 250d0ee7c97e88aca400d0e8075c08fc
- SHA1 4d19ab2a18d33db4326c3cb715a3fac030da3cd2
- SHA512 3d42db7f63f5fcebdf75175950820fe4e006d26fe55f3f717dc9a7c33928d7a19dfa83cb57135ee7cc019cf9f9a5e467ee7562c753c5f5a85743619dd785e577
- TLSH T12AF07D8C410A435E1422258AA6BB3BD517E01C2087493AF4F5628D43E78DDD294FE6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa9D80.tmp\ioSpecial.ini
- Size 654B
- SHA256 2b479d01518fb220e35041cb3f034936c99d64b318ef348e13fe729f6307fb25
- MD5 1c587f6cde0edc412ae73855c82e254d
- SHA1 1b5d5d8cc594c3eac6c6ab795c9ada9569b2d888
- SHA512 f0a419e79189eeceff4e006b9f8ba142de008eaabd8de2f395437c12a7f64378a9e42d7f7225b4a7807975543c4744c2a744dfd650cb65b1c55b3fc3bd6863e0
- TLSH T196F07D8C410A435E5822258AA6BB3BD517E01C2487493AF4F5728D83EB8DDD294FE6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa9D80.tmp\nsa9D81.tmp
- Size 1KB
- SHA256 77d6e1d0a6f03928c22b36df8e5eef893ef3a9f5d296d64b6dcae9c260b74b76
- MD5 a1a44def8d393ea6a9d743975dffa822
- SHA1 bbeb7122c3e3b876af18880c4302ba3992e843a1
- SHA512 09fb3374805da97f107d4933e7ad8cb03b877893114e81c2525ae0e80593537b0c23b52acba600b52b71881c44f34994bf61b83534bfb0a730c835af0973a918
- TLSH T171215A8C9146929DC934D0971C7F7D85B7F02D244B856DA0F2A62C43B78CDE6A4AC289
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa9D80.tmp\nsa9D81.tmp
- Size 1KB
- SHA256 5ef6f6689264c6886b100f017a995c20567aec545c904591c09349415a42d512
- MD5 427444556a88655aa3a209d7b756279b
- SHA1 d4c10b27b0a6a682242c889ce9228a3cf330e883
- SHA512 aaab7557f6bb384df3ef3300d5f0475ef5589134b1e313e4676f3800ab398a20217648464dde56ac7979c60299829570d51ada2278980e3b156da6ceee77e5a7
- TLSH T1A121288CD183C26D8A20D0571CBB79D9B7F02D240F817DB0F2A62C47B78CDE658AD289
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsa9D80.tmp\nsa9D81.tmp
- Size 1KB
- SHA256 e052fd6371e2a14b5ebd712031372bfe9f34f2c4c93d86a15b3d382c4a28bc1e
- MD5 528b24673626f3a2f26de640fe436d9c
- SHA1 80b28f885235410ddf1c55a55200367667530f91
- SHA512 7c4c0f6cc93e5e8d7d7317fbfcf8c28ce3b64e7dd98373072fc6ba0f9b7b1116a0248dc49db153c585e2ae7996c386e8173f652e99285ae74195c8644c662fa6
- TLSH T147214C8CD146929DC934D0971C7F7DC5B3F01D244B857DA0F2A62C43B38CDE694AC289
- MD5 SHA1 SHA512 TLSH