Overview

overview

6

Static

static

1

2026-07-18...os.exe

windows10-2004-x64

6

2026-07-18...os.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/07/2026, 08:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
  • Size 2.6MB
  • Sample260718-krbjsaev2m
  • SHA256 3ddbfa94c99b35c197db61a2eec794961e624689f2e69eeaa2247afecd8c3f26
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe -sendDump="C:\Users\Admin\AppData\Local\Temp/KAVINST.21.3.12.434_07.18_09.49_5068.SETUP.full.dmp"
      2⤵
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4696

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        check_new_version.html
        • Path C:\Users\Admin\AppData\Local\Temp\9BF8A2EB-8285-11F1-BC3D-C69B2EA1B5B9\check_new_version.html
        • Size 1KB
        • SHA256 2d5ef39f7d18fd00ae43d48d34d993fbcaf539636c708d781dde06f60e5f1c97
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install_error_send_logs_page.html
        • Path C:\Users\Admin\AppData\Local\Temp\9E7535C1-8285-11F1-BC3D-C69B2EA1B5B9\install_error_send_logs_page.html
        • Size 2KB
        • SHA256 03d4bb7cb4236874d35175b4690d259480959dd24bc6d667fce222ad47b84f4a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jquery-1.12.4.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\9E7535C1-8285-11F1-BC3D-C69B2EA1B5B9\jquery-1.12.4.min.js
        • Size 94KB
        • SHA256 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jquery.custom_select.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\9E7535C1-8285-11F1-BC3D-C69B2EA1B5B9\jquery.custom_select.min.js
        • Size 5KB
        • SHA256 dd678d32073078552e0e2c35eed78f16cc8d6e8662d4734518561a1b183f775c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-print.css
        • Path C:\Users\Admin\AppData\Local\Temp\9E7535C1-8285-11F1-BC3D-C69B2EA1B5B9\kis-print.css
        • Size 306B
        • SHA256 2481b34b48fd96b194405da621e8e5f19142dcb55744f9c9a93591705cb697fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script-lte-ie8.js
        • Path C:\Users\Admin\AppData\Local\Temp\9E7535C1-8285-11F1-BC3D-C69B2EA1B5B9\kis-script-lte-ie8.js
        • Size 1KB
        • SHA256 33e84b33ff911257e3a6a303c08a2cc178827dadb7dfd7c951e096866e02ad5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script.js
        • Path C:\Users\Admin\AppData\Local\Temp\9E7535C1-8285-11F1-BC3D-C69B2EA1B5B9\kis-script.js
        • Size 306B
        • SHA256 97e5f342227ea23c27c1b660f111847fcdd9d7b23c1d248c733a36f983fd7f04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-style.css
        • Path C:\Users\Admin\AppData\Local\Temp\9E7535C1-8285-11F1-BC3D-C69B2EA1B5B9\kis-style.css
        • Size 29KB
        • SHA256 f9963b403e053f6bfa7c87cad3c10dd55cf1f94fefe00c6380921440e28b48d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.dll
        • Path C:\Users\Admin\AppData\Local\Temp\AE2A8FB958281F11CBD36CB9E21A5B9B\setup.dll
        • Size 5.0MB
        • SHA256 d02fb965d899daaf31d3430231f19a0ba559b82dedcff0febe130aa658211475
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4696-39-0x00000000777C0000-0x00000000777D0000-memory.dmp
        Download

        memory/4696-40-0x00000000777C0000-0x00000000777D0000-memory.dmp
        Download

        memory/4696-41-0x00000000777C0000-0x00000000777D0000-memory.dmp
        Download

        memory/5068-2-0x00000000777E0000-0x00000000777F0000-memory.dmp
        Download

        memory/5068-1-0x00000000777E0000-0x00000000777F0000-memory.dmp
        Download

        memory/5068-0-0x00000000777E0000-0x00000000777F0000-memory.dmp
        Download