Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 16:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_e6b356c0011ab77a0e75ca6724e1040e_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-22_e6b356c0011ab77a0e75ca6724e1040e_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
- Size 9.1MB
- Sample260722-vc5jeshf57
- SHA256 4252074703d57a5cc77679158c721c9738efdd417ae8f7c2bb9d03c8336cd1c6
- MD5 e6b356c0011ab77a0e75ca6724e1040e
- SHA1 bf015cf1f092a6c1f95497f99b8c12003ea4419b
- SHA512 b1752517f852fa5deee376d72d84b805b43bd978819e090d89b56a67903a611e04dc37d408473f04cd14c4ffdf020524c39623ab0723182c1dd9dca6bfc694c7
- SSDEEP 196608:s/penceWhoiBHH+Hk5/+h+pIcf//wZU2i8ci73/xw:s/penZWhMhNcf/IZHiNi7vxw
- TLSH T12FA601C07361F858DB990270093976F4866A26303710D9FFBE9F7AC619682C5ADF1E36
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1984 akelpad_setup.exe 2352 AkelPad.exe 4456 AkelPad.exe - Loads dropped DLL 3 IoCs
pid Process 1984 akelpad_setup.exe 1984 akelpad_setup.exe 1984 akelpad_setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\SpellCheck.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\perl.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\qsfndall_tolog.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\CSS\style.css akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ContextMenu-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\MinimizeToTray-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\nsis.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\EvalCmd.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\BATCH\batch.cmd akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\XML\general.xml akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Log-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SpecialChar-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Speech-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\rc.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds\Movement.wav akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\HexSel-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Speech-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ToolBar-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\LineBoard.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\bat.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\ColumnCounter.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\AkelPad\Template.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\RecentFiles.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\au3.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\AkelPad\scripts.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Clipboard.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\Include\ShowMenu.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\Assemblers\win32-flat.asm akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\XML\XHTML\xhtml1ts.xhtml akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\QSearch-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Scroll-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Templates-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\German.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Greek.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\asm.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\xml.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\Calculator.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SmartSel-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Hotkeys-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Exit-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Exit-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Macros-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SaveFile-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Brazilian.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\PASCAL\unit.pas akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ContextMenu-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\LineBoard-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sessions.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Sounds-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Stats-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Fonts.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\HexSel.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\MinimizeToTray.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\js.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\python.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\SearchReplace.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\AkelAdmin.exe akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Coder-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\RecentFiles-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\LinesFilter.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds\Char.wav akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Hotkeys-Rus.txt akelpad_setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_e6b356c0011ab77a0e75ca6724e1040e_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language akelpad_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AkelPad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AkelPad.exe - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x0006000000016b5e-4.dat nsis_installer_1 behavioral2/files/0x0006000000016b5e-4.dat nsis_installer_2 behavioral2/files/0x000c00000001c676-433.dat nsis_installer_1 behavioral2/files/0x000c00000001c676-433.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4152 wrote to memory of 1984 4152 2026-07-22_e6b356c0011ab77a0e75ca6724e1040e_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 89 PID 1984 wrote to memory of 2352 1984 akelpad_setup.exe 90 PID 1984 wrote to memory of 4456 1984 akelpad_setup.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_e6b356c0011ab77a0e75ca6724e1040e_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_e6b356c0011ab77a0e75ca6724e1040e_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\7zS83039829\akelpad_setup.exe.\akelpad_setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Program Files (x86)\AkelPad\AkelPad.exe"C:\Program Files (x86)\AkelPad\AkelPad.exe" /reassoc /quit3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352
-
-
C:\Program Files (x86)\AkelPad\AkelPad.exe"C:\Program Files (x86)\AkelPad\AkelPad.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4456
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\AkelPad\AkelFiles\Uninstall.exe
- Size 54KB
- SHA256 c9ab37c4f1ad6511ba7a2d72485b419af366c317fb4c00d2b7c623dc0fe90e32
- MD5 eaa245e39f16098675e81fbab307aa4c
- SHA1 2e66f071b8a95488d34d7e0da0f49b4ac7c073e2
- SHA512 0f56ab88530752132b57688196b97a70788a5a7af44fb8fdb32fe271f6a6e196bdeeec683e763c3ff0949f9cb4ea74e1d3397c19f5ed04bc36003059d31bbadf
- SSDEEP 768:+1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJ0t3DNDmjS2vqEFdmNbJmBFeWWs:8QpQ5EP0ijnRTXJ05NDmjJCJmBwPs
- TLSH T13D43BF1379D3CCA7F24A063126BBD3B6E2F5F34522710647DB681FBEE9141839915392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\AkelPad\AkelPad.exe
- Size 410KB
- SHA256 bcf96667f2b87623045580c7ab9ca93c19189fec9841fb07af3f54524fccafe8
- MD5 8f14b29e61aa73b27ac8389e8a02a0d8
- SHA1 078675252356a5bb7d6dc6e294e7ee6a16fd71d2
- SHA512 8fe990ccc7ea369112b2bd8b3f19ee24d297dbb5f9d7e2c79fd89fdf89f8cd5741f63933d95dee31acc6e2492aac61109311b030743068d574952c984841d5e7
- SSDEEP 12288:eP9HkdNJ0bFCuN1hNpoy6AUjqN4Tid1oNkDfibxOH:eP9HkHJ0bFLN1hNWkUjqN4TidaNymO
- TLSH T1E9948E52F1F2C032D4B3C9702D9B57A56FBAFE1018358D47A3D439CDA271692EA2631E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS83039829\akelpad_setup.exe
- Size 1.2MB
- SHA256 ad63ea4048d68721701a3c0d2d9041a158e90789c7fc24526380607aad136aca
- MD5 0ac63da17f7003c1ad26906d0a72f4fd
- SHA1 339d723c3d19fd334a508b5148207bbdab0cfd5f
- SHA512 cc3633bd935774a741609bebe6d63368a273686f7ae704536d867e741559d5676dce92a6d826eafdc8441554326966d62962ced4e8809ee9a519a5c43cf6e3f3
- SSDEEP 24576:sqIJQXd7CUwcof6p2n/hhlGXZTIhnZNK335Yya78/d:AA7fofZnNSMCpfd
- TLSH T1E645334280E6C8BBCA95503116A7AB7BEBBCDF2647AB070B5752BF76F8743010681747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6B07.tmp\InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6B07.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6B07.tmp\ioSpecial.ini
- Size 645B
- SHA256 70f8d7438b3678eb36a80c94337b87a224cd26b9c0be64faaa2136a62c8f8e37
- MD5 5a826b0bc22f579a1af5e3685ee8f0c5
- SHA1 2ba51e984c941c20715322793d824f0b6cd1ed2a
- SHA512 ea4dd3b8dfdf6f6d9dcaaded2e2665f9511e81c1100d1da68f6ef1c980901d23d1d1d3af25544c5e69ef4083a1de3be4456306260d2be5e59fbd1c6ed2a7ab7d
- TLSH T1D7F07D8C410A431E48226156A6BE3BD117E01C34478539F5F5638D83DB8DDD688FD6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6B07.tmp\ioSpecial.ini
- Size 645B
- SHA256 ffca3987620e037a0ad179bdd892daa2a8bda73aab21ec8ae66313603b2fb7dd
- MD5 3d0f4223ad5e9fabcfee62852db0e0e2
- SHA1 c749cf35ca8802817776f6e4847e20fc7ed59de3
- SHA512 6f9aa5d872050c4b5973ec89810225dda289b0f2068d4eb8eb82c4d084d8d58a5a037509b510752bddee94019f5ca8e327bc0a90c7effad7fd9ad8c26675e2ab
- TLSH T1A2F07D8C400A435E0422618AAABA3F9127D01C24878936F1F5628D43DB8DDD6C4ED6C6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6B07.tmp\ioSpecial.ini
- Size 654B
- SHA256 b0e7f920ef076e94dc40a761fce6cde71a87bf16dfbf2e9a7c441c9f32563797
- MD5 135a250becfcab5f4215facb07d1bc1d
- SHA1 1f83fc98ed2946f10b5f486787815574d75c7301
- SHA512 e407a2e56556432a518bd00a38943b50950966d0daf1b6f7b9440d3076692426e739c55116ecdcf50a5fe5adb5c3e08c8ba7c5fbc4755102e19c6d81216c5a9e
- TLSH T114F07D8C400A435E4822618AAAFE3F9127D01C24878936F1F5628D83DB8DDD6D4ED6C5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6B07.tmp\nsb6B08.tmp
- Size 1KB
- SHA256 b96f99b3af7b87c1a47bf4c76d00e58626c7d455ce5d90221eb91878e7947998
- MD5 ad2ba782f4fbb53e854f0adc2bcc9eae
- SHA1 f17b9c258b3b8084f61bf583ce04a09994b0b394
- SHA512 2ac0ba3a02c23798ea1e41cea3e58608f6dd47035c7ea428fc4ed0deec7719359b6e4ab8c46d7284fe8f2ae25818cfb121d1d525a01473760e5a3bc7e1ad3ae9
- TLSH T136214C88D086925D8074D0D61CAF7999F3E03E244FC57DA4F2A66C4397CECF6D49D249
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6B07.tmp\nsb6B08.tmp
- Size 1KB
- SHA256 b9e73362ef9d8bdc3cbbcbbc304bb0dc1c764ee80a8c9b7ca25224be4e213db9
- MD5 a79feeb1bbeeb0a948f375bfa95ad5a2
- SHA1 2ae290cbef22fcacced4be4776854d39d358dda0
- SHA512 320c2a21ae216e7b3d70463adbe07dc52fbf120bae14c6987466f36201b0838ecdd22d5e7842f40290cc11b7915160a1506ec4913af3f2f73a9531ac4a53bbd3
- TLSH T1FB215A88D086925D8464D0961CAF7989F7E03E285FC57DA0F2A66C439B8ECF6D49C289
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsb6B07.tmp\nsb6B08.tmp
- Size 1KB
- SHA256 5028a539084461f300e97f3a48d6b8d4511da3e15982fdbfa9ad83ce6552899f
- MD5 88f9b0a78d7550876e6ccb487988d642
- SHA1 8eeedb789db498c5e16ca3dbff84c77614d37f56
- SHA512 55456fd5c4abbeaa7bc6afa2282b84f36146c60da351ce088d22df98abe9c2c92eb363aba99b06cdff580c8bfbedcb696458ee9d7d59ced06e3cc8f6859207bb
- TLSH T1AA21C888D082921D8470D1561CAB7999F7E03D241F817DA4F2A76C439B8ECF6D89D289
- MD5 SHA1 SHA512 TLSH