Overview

overview

6

Static

static

1

2026-07-20...os.exe

windows10-2004-x64

6

2026-07-20...os.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/07/2026, 09:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_63a562699734a9c16dd56b3470a705f1_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
  • Size 2.6MB
  • Sample260720-lrpl3sdw4m
  • SHA256 1d419ccac1d1a613add5a1eb8d51d7b125a42198ed9d5134e08bf11a27fc377f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
bootkitdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_63a562699734a9c16dd56b3470a705f1_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_63a562699734a9c16dd56b3470a705f1_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Users\Admin\AppData\Local\Temp\2026-07-20_63a562699734a9c16dd56b3470a705f1_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-20_63a562699734a9c16dd56b3470a705f1_amadey_elex_luca-stealer_lynx_medusalocker_njrat_remcos.exe -sendDump="C:\Users\Admin\AppData\Local\Temp/KAVINST.21.3.12.434_07.20_10.46_4816.SETUP.full.dmp"
      2⤵
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4356

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        setup.dll
        • Path C:\Users\Admin\AppData\Local\Temp\8C7E468DF1481F11F9C3655DA2CEF600\setup.dll
        • Size 5.0MB
        • SHA256 42dff88798d58fa37ad89f6437f70044b097daaf77df5e8a02af55b1fa51b454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        check_new_version.html
        • Path C:\Users\Admin\AppData\Local\Temp\D864E7C9-841F-11F1-9F3C-56D52AEC6F00\check_new_version.html
        • Size 1KB
        • SHA256 9b09056cd97a29bea0025dc3cb5afe10769b2c719df19b6c47adaaa79f578238
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install_error_send_logs_page.html
        • Path C:\Users\Admin\AppData\Local\Temp\DAD58FC0-841F-11F1-9F3C-56D52AEC6F00\install_error_send_logs_page.html
        • Size 2KB
        • SHA256 512ca20e4f3bcb2ed321f4011876b847611e4727723c1d27dc5cf78f3c88e3b0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        jquery-1.12.4.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\DAD58FC0-841F-11F1-9F3C-56D52AEC6F00\jquery-1.12.4.min.js
        • Size 94KB
        • SHA256 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jquery.custom_select.min.js
        • Path C:\Users\Admin\AppData\Local\Temp\DAD58FC0-841F-11F1-9F3C-56D52AEC6F00\jquery.custom_select.min.js
        • Size 5KB
        • SHA256 dd678d32073078552e0e2c35eed78f16cc8d6e8662d4734518561a1b183f775c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kis-print.css
        • Path C:\Users\Admin\AppData\Local\Temp\DAD58FC0-841F-11F1-9F3C-56D52AEC6F00\kis-print.css
        • Size 306B
        • SHA256 2481b34b48fd96b194405da621e8e5f19142dcb55744f9c9a93591705cb697fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script-lte-ie8.js
        • Path C:\Users\Admin\AppData\Local\Temp\DAD58FC0-841F-11F1-9F3C-56D52AEC6F00\kis-script-lte-ie8.js
        • Size 1KB
        • SHA256 33e84b33ff911257e3a6a303c08a2cc178827dadb7dfd7c951e096866e02ad5e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-script.js
        • Path C:\Users\Admin\AppData\Local\Temp\DAD58FC0-841F-11F1-9F3C-56D52AEC6F00\kis-script.js
        • Size 306B
        • SHA256 97e5f342227ea23c27c1b660f111847fcdd9d7b23c1d248c733a36f983fd7f04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        kis-style.css
        • Path C:\Users\Admin\AppData\Local\Temp\DAD58FC0-841F-11F1-9F3C-56D52AEC6F00\kis-style.css
        • Size 29KB
        • SHA256 f9963b403e053f6bfa7c87cad3c10dd55cf1f94fefe00c6380921440e28b48d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4356-40-0x00000000772D0000-0x00000000772E0000-memory.dmp
        Download

        memory/4356-41-0x00000000772D0000-0x00000000772E0000-memory.dmp
        Download

        memory/4356-39-0x00000000772D0000-0x00000000772E0000-memory.dmp
        Download

        memory/4816-0-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download

        memory/4816-1-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download

        memory/4816-2-0x00000000772C0000-0x00000000772D0000-memory.dmp
        Download