Overview

overview

6

Static

static

1

2026-07-18...os.exe

windows10-2004-x64

6

2026-07-18...os.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 08:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
  • Size 2.6MB
  • Sample260718-krbjsaev2m
  • SHA256 3ddbfa94c99b35c197db61a2eec794961e624689f2e69eeaa2247afecd8c3f26
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-18_10bc26334b7efb3c2d71156d393d0b7b_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe -sendDump="C:\Users\Admin\AppData\Local\Temp/KAVINST.21.3.12.434_07.18_09.49_1412.SETUP.full.dmp"
      2⤵
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1140

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        setup.dll
        • Path C:\Users\Admin\AppData\Local\Temp\75D123E958281F11DA85E52CD26283EF\setup.dll
        • Size 5.0MB
        • SHA256 d02fb965d899daaf31d3430231f19a0ba559b82dedcff0febe130aa658211475
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        check_new_version.html
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\check_new_version.html
        • Size 1KB
        • SHA256 2d5ef39f7d18fd00ae43d48d34d993fbcaf539636c708d781dde06f60e5f1c97
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jquery-1.12.4.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\jquery-1.12.4.min.js
        • Size 94KB
        • SHA256 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jquery.custom_select.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\jquery.custom_select.min.js
        • Size 5KB
        • SHA256 dd678d32073078552e0e2c35eed78f16cc8d6e8662d4734518561a1b183f775c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-loading.gif
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\kis-loading.gif
        • Size 10KB
        • SHA256 f056164cf99799234c90e2318e90ab5d83d0fd855118224286ff0680ee455734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-logo.png
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\kis-logo.png
        • Size 4KB
        • SHA256 681a96b96b5e0425fc74be929d29164528bf0bc0a84ac97952c011e407e23d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-print.css
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\kis-print.css
        • Size 306B
        • SHA256 2481b34b48fd96b194405da621e8e5f19142dcb55744f9c9a93591705cb697fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script-lte-ie8.js
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\kis-script-lte-ie8.js
        • Size 1KB
        • SHA256 33e84b33ff911257e3a6a303c08a2cc178827dadb7dfd7c951e096866e02ad5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script.js
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\kis-script.js
        • Size 306B
        • SHA256 97e5f342227ea23c27c1b660f111847fcdd9d7b23c1d248c733a36f983fd7f04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-style.css
        • Path C:\Users\Admin\AppData\Local\Temp\9E321D58-8285-11F1-AD58-5EC22D2638FE\kis-style.css
        • Size 29KB
        • SHA256 f9963b403e053f6bfa7c87cad3c10dd55cf1f94fefe00c6380921440e28b48d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install_error_send_logs_page.html
        • Path C:\Users\Admin\AppData\Local\Temp\A14C29C3-8285-11F1-AD58-5EC22D2638FE\install_error_send_logs_page.html
        • Size 2KB
        • SHA256 03d4bb7cb4236874d35175b4690d259480959dd24bc6d667fce222ad47b84f4a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-error.png
        • Path C:\Users\Admin\AppData\Local\Temp\A14C29C3-8285-11F1-AD58-5EC22D2638FE\kis-error.png
        • Size 275B
        • SHA256 a941af55adff84f31549a72042eeebdd297f1de54a5d346e1667e11a2372dea4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1140-67-0x0000000077BA0000-0x0000000077BB0000-memory.dmp
        Download

        memory/1140-68-0x0000000077BA0000-0x0000000077BB0000-memory.dmp
        Download

        memory/1140-66-0x0000000077BA0000-0x0000000077BB0000-memory.dmp
        Download

        memory/1412-0-0x0000000077B90000-0x0000000077BA0000-memory.dmp
        Download

        memory/1412-1-0x0000000077B90000-0x0000000077BA0000-memory.dmp
        Download

        memory/1412-2-0x0000000077B90000-0x0000000077BA0000-memory.dmp
        Download