Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 05:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-17_00642e97be0234c24bd4f17c256c46e4_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-17_00642e97be0234c24bd4f17c256c46e4_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
- Size 5.6MB
- Sample260718-fp66fsct61
- SHA256 0752cff172790ec6b5811ff60a9370febab11b27d2339345bfd39979208997ef
- MD5 00642e97be0234c24bd4f17c256c46e4
- SHA1 ad4796853a12127f65ee98c27b0792936f0f8ea7
- SHA512 fcde9858545e2889337de74c670b977bf83360cd9a54f54fad509d281788d39aa689eabe83d68fbc51d18d7208892d04ec61ea1448483d17d7646ae6643f2e23
- SSDEEP 98304:bAU8zEN8UXly3tXvTKfPFsK+G3NT29Y8YoMVTW7i4Hy7I0r/xw:jOOrXwXvTUtsK+ONWYdqHy73/xw
- TLSH T1FC56DFC07361F828EB564270483A76F8966626303311D9EFBE8F76D2195C7D4ADB0E36
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 3228 akelpad_setup.exe 5996 AkelPad.exe 4136 AkelPad.exe - Loads dropped DLL 3 IoCs
pid Process 3228 akelpad_setup.exe 3228 akelpad_setup.exe 3228 akelpad_setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\Calculator.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\InsertDate.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\ASP\ASP_VBS.asp akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\ASP.NET\ASP_Csharp.aspx akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Scroll-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\sql.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\Include\ShowMenu.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Exit-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Explorer-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Fonts-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\LineBoard-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\RecentFiles-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Scripts-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SpellCheck-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Dutch.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\FullScreen-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\FullScreen-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\HexSel.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\MinimizeToTray.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Stats.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\asm.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\Keyboard.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ContextMenu-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\HexSel-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\LineBoard-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\XBrackets.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\inno.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\RenameFile.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds\Delete.wav akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Hungarian.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\LinesFilter.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds\Return.wav akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ContextMenu-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ToolBar-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Chinese (Simplified).dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\html.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds\Char.wav akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\HTML\html4fs.html akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\HTML\html4s.html akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\AkelHelp-Eng.htm akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Fonts-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Macros-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Templates-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\XBrackets-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Polish.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Clipboard.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Hotkeys.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\AkelHelp-Rus.htm akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Format-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\cpp.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\css.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\ASP\ASP_JS.asp akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\BATCH\batch.cmd akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\CSS\style.css akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\PASCAL\unit.pas akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\SaveFile.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Slovak.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\ContextMenu.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SmartSel-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Belorussian.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Finnish.dll akelpad_setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_00642e97be0234c24bd4f17c256c46e4_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language akelpad_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AkelPad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AkelPad.exe - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000e00000001c563-4.dat nsis_installer_1 behavioral2/files/0x000e00000001c563-4.dat nsis_installer_2 behavioral2/files/0x000c00000001c65d-433.dat nsis_installer_1 behavioral2/files/0x000c00000001c65d-433.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3536 wrote to memory of 3228 3536 2026-07-17_00642e97be0234c24bd4f17c256c46e4_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 88 PID 3228 wrote to memory of 5996 3228 akelpad_setup.exe 89 PID 3228 wrote to memory of 4136 3228 akelpad_setup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_00642e97be0234c24bd4f17c256c46e4_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_00642e97be0234c24bd4f17c256c46e4_amadey_coinminer_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\7zS0DDDD6E9\akelpad_setup.exe.\akelpad_setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Program Files (x86)\AkelPad\AkelPad.exe"C:\Program Files (x86)\AkelPad\AkelPad.exe" /reassoc /quit3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5996
-
-
C:\Program Files (x86)\AkelPad\AkelPad.exe"C:\Program Files (x86)\AkelPad\AkelPad.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4136
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\AkelPad\AkelFiles\Uninstall.exe
- Size 54KB
- SHA256 c9ab37c4f1ad6511ba7a2d72485b419af366c317fb4c00d2b7c623dc0fe90e32
- MD5 eaa245e39f16098675e81fbab307aa4c
- SHA1 2e66f071b8a95488d34d7e0da0f49b4ac7c073e2
- SHA512 0f56ab88530752132b57688196b97a70788a5a7af44fb8fdb32fe271f6a6e196bdeeec683e763c3ff0949f9cb4ea74e1d3397c19f5ed04bc36003059d31bbadf
- SSDEEP 768:+1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJ0t3DNDmjS2vqEFdmNbJmBFeWWs:8QpQ5EP0ijnRTXJ05NDmjJCJmBwPs
- TLSH T13D43BF1379D3CCA7F24A063126BBD3B6E2F5F34522710647DB681FBEE9141839915392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\AkelPad\AkelPad.exe
- Size 410KB
- SHA256 bcf96667f2b87623045580c7ab9ca93c19189fec9841fb07af3f54524fccafe8
- MD5 8f14b29e61aa73b27ac8389e8a02a0d8
- SHA1 078675252356a5bb7d6dc6e294e7ee6a16fd71d2
- SHA512 8fe990ccc7ea369112b2bd8b3f19ee24d297dbb5f9d7e2c79fd89fdf89f8cd5741f63933d95dee31acc6e2492aac61109311b030743068d574952c984841d5e7
- SSDEEP 12288:eP9HkdNJ0bFCuN1hNpoy6AUjqN4Tid1oNkDfibxOH:eP9HkHJ0bFLN1hNWkUjqN4TidaNymO
- TLSH T1E9948E52F1F2C032D4B3C9702D9B57A56FBAFE1018358D47A3D439CDA271692EA2631E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS0DDDD6E9\akelpad_setup.exe
- Size 1.2MB
- SHA256 ad63ea4048d68721701a3c0d2d9041a158e90789c7fc24526380607aad136aca
- MD5 0ac63da17f7003c1ad26906d0a72f4fd
- SHA1 339d723c3d19fd334a508b5148207bbdab0cfd5f
- SHA512 cc3633bd935774a741609bebe6d63368a273686f7ae704536d867e741559d5676dce92a6d826eafdc8441554326966d62962ced4e8809ee9a519a5c43cf6e3f3
- SSDEEP 24576:sqIJQXd7CUwcof6p2n/hhlGXZTIhnZNK335Yya78/d:AA7fofZnNSMCpfd
- TLSH T1E645334280E6C8BBCA95503116A7AB7BEBBCDF2647AB070B5752BF76F8743010681747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseFF38.tmp\InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseFF38.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseFF38.tmp\ioSpecial.ini
- Size 645B
- SHA256 3da4ac4eb00a6728705ceb37aa5292319c052d27a8cabfc38c7d47071328c471
- MD5 1177e2ef61e9ef56e9a5bb85d57ffc83
- SHA1 c36fdcd07b0c5f14a304190798a111f6c1b75595
- SHA512 ddd3b61f76d594cc0eaf92d8efb33c7db48d485a443712153acef1992a85e8f2c12c8e7f6278e07add40456df1f5938fcf528f5c1795dedea985e92cd7d1edfd
- TLSH T18BF07D8C500A431E04121586A6FE3FD113D01C24878979F5F6638D43DB4CDD584ED6C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseFF38.tmp\ioSpecial.ini
- Size 654B
- SHA256 dea610c770280461131dd97c6afae26b14076bd7f8b4baf93ed3ca8ee8a5c10f
- MD5 be38c2010fd6db42650735b9bc80153a
- SHA1 d07b70c158a2c6f68a0d2a30397dce4bc58bb351
- SHA512 c43fec0cde84f027c60b4f4b9f10784e66be0aae517654674e26f73d106056ce2ffff53114fbf546235e0ff44496fe371727594d70cd8cf0613cf63f4206a29c
- TLSH T183F07D8C500A431E08221586A6FE3FD113D01D24878979F5F6638D83DB4DDD594ED6C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseFF38.tmp\nseFF39.tmp
- Size 1KB
- SHA256 fade8ef2d65bccf6285146b569e43be03aa4d537ccab9b05a8d30ffc71c28182
- MD5 37acc21641591cc0491f725e5b54be64
- SHA1 addc3cbe68886b406bf7ea0f04b96333ed4e84d1
- SHA512 223cc9cdf519ce854321e4ddd26e1fef15c1a0baaf1f3262b3e40454b81104766216e6838acb88e823068403af6720c5cfed1857251124dfc2681f28b2f135b3
- TLSH T1DD216B88D042825E8474C5D62C7F7DC6B3E02D284FC97DB4F2AA6C479B8DDE6989C14A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseFF38.tmp\nseFF39.tmp
- Size 1KB
- SHA256 4694cc921d76d69b17b1cffc988de7dbb9abc508035404d8633b18ddde1ff01d
- MD5 c4728e8a0c15bd04ae148f49350ded62
- SHA1 a8b56385c17d7c32d774a6af39781dbb74a417c1
- SHA512 d2ba19290ccf5c30c01ba80771d224c21a786fda0d5950a6794a3c8c43f192eefa61f20ba7be8053341b9c5c1057854be8e5e4eb481d840238bb4c1c398490e8
- TLSH T156210A89D082921E8470C4961CBF6DD9B3E12C280FC17DB4F2A62C47DB8DCE658DD189
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nseFF38.tmp\nseFF39.tmp
- Size 1KB
- SHA256 4e6d4940cce87cbc64864c4ec9c7cc343a31ed8a3168de4fa5de72e1b2600607
- MD5 485797e29ee6a3ac88d6c88c4e34ac06
- SHA1 387c3135ed9cf36c922dc6cfc67f124410b7bf0e
- SHA512 a703b4a22c666f06bdb078fb7f5a9e507327300b45ea6ccc2e7268a95c437d7c7ff5064b369936a49605289e18dcd6dc752ad1f27c76da6f622d8d94576dbfcf
- TLSH T1E4217C88D042825E8434C5D61C7F7DC5B3E02D285FC57DB4F2A66C479B8DDE6989C14A
- MD5 SHA1 SHA512 TLSH