Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 18:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-22_30e0709aec804b105f40ceef1ae97537_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-22_30e0709aec804b105f40ceef1ae97537_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
- Size 9.1MB
- Sample260722-wmlpqs1dlb
- SHA256 e647e6df723d4598a0b9362248ae6031b5dbbb84c7bdb5eedb4ac60fb9d987d7
- MD5 30e0709aec804b105f40ceef1ae97537
- SHA1 17a27f8240506d6dedd86b3533ed752b5a656608
- SHA512 b993cb0b757da881803cff01c4c20fcfb27ac7c3f0943e1ecf8757b16f1400908ca3b513c81fc1199eb2098b770f40c62c02a5500430f5ebdda25624146f3fff
- SSDEEP 196608:GT7DEIgP6Xs0qhTI1MU3ytgAe//dGooWiP5dsZ+O+x73/xw:GT7DEC0a1MUitgAe3z+5dsZ+OQ7vxw
- TLSH T196A601C07765F818E75906700836B6F496662A313310D9EAFECB7AC2196C3C5ADF1E36
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
pid Process 1264 akelpad_setup.exe 2688 AkelPad.exe 3200 AkelPad.exe - Loads dropped DLL 3 IoCs
pid Process 1264 akelpad_setup.exe 1264 akelpad_setup.exe 1264 akelpad_setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\CSS\style.css akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Exit-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Sessions-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\css.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\pascal.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\php.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Greek.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SpellCheck-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Catalan.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\AkelHelp-Eng.htm akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\AkelHistory-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\HexSel-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\AkelPad\scripts.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Hotkeys-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Log-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Chinese (Traditional).dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Macros.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\xml.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\SearchReplace.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\ASP.NET\ASP_Csharp.aspx akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\HTML\html4fs.html akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Clipboard-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\FullScreen-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Macros-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Macros-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SmartSel-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\SpecialChar-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\LineBoard.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\MinimizeToTray.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\AkelHistory-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Czech.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Exit.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scroll.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\1s.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\ToolBar-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\sql.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds\Delete.wav akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Scroll-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Sessions-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\RecentFiles.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Sounds\Movement.wav akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\ASP\ASP_VBS.asp akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\XML\general.xml akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\AkelUpdater.exe akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Scripts-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Belorussian.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Langs\Finnish.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates.dll akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\cpp.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\Test.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\ASP.NET\ASP_VB.aspx akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\LineBoard-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Fonts-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\MinimizeToTray-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Scripts\InsertFile.js akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\ASP\ASP_JS.asp akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\C-Language\hello.c akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\HTML\html4ts.html akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Templates\XML\XHTML\xhtml1s.xhtml akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\LineBoard-Rus.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Sounds-Eng.txt akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\Coder\au3.coder akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Plugs\SpellCheck\cpp.spck akelpad_setup.exe File created C:\Program Files (x86)\AkelPad\AkelFiles\Docs\Fonts-Eng.txt akelpad_setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_30e0709aec804b105f40ceef1ae97537_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language akelpad_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AkelPad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AkelPad.exe - NSIS installer 4 IoCs
resource yara_rule behavioral2/files/0x000500000001b853-4.dat nsis_installer_1 behavioral2/files/0x000500000001b853-4.dat nsis_installer_2 behavioral2/files/0x000c00000001c612-433.dat nsis_installer_1 behavioral2/files/0x000c00000001c612-433.dat nsis_installer_2 - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3968 wrote to memory of 1264 3968 2026-07-22_30e0709aec804b105f40ceef1ae97537_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 89 PID 1264 wrote to memory of 2688 1264 akelpad_setup.exe 90 PID 1264 wrote to memory of 3200 1264 akelpad_setup.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_30e0709aec804b105f40ceef1ae97537_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_30e0709aec804b105f40ceef1ae97537_amadey_elex_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\7zS08FDFD5A\akelpad_setup.exe.\akelpad_setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Program Files (x86)\AkelPad\AkelPad.exe"C:\Program Files (x86)\AkelPad\AkelPad.exe" /reassoc /quit3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688
-
-
C:\Program Files (x86)\AkelPad\AkelPad.exe"C:\Program Files (x86)\AkelPad\AkelPad.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3200
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\AkelPad\AkelFiles\Uninstall.exe
- Size 54KB
- SHA256 c9ab37c4f1ad6511ba7a2d72485b419af366c317fb4c00d2b7c623dc0fe90e32
- MD5 eaa245e39f16098675e81fbab307aa4c
- SHA1 2e66f071b8a95488d34d7e0da0f49b4ac7c073e2
- SHA512 0f56ab88530752132b57688196b97a70788a5a7af44fb8fdb32fe271f6a6e196bdeeec683e763c3ff0949f9cb4ea74e1d3397c19f5ed04bc36003059d31bbadf
- SSDEEP 768:+1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJ0t3DNDmjS2vqEFdmNbJmBFeWWs:8QpQ5EP0ijnRTXJ05NDmjJCJmBwPs
- TLSH T13D43BF1379D3CCA7F24A063126BBD3B6E2F5F34522710647DB681FBEE9141839915392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\AkelPad\AkelPad.exe
- Size 410KB
- SHA256 bcf96667f2b87623045580c7ab9ca93c19189fec9841fb07af3f54524fccafe8
- MD5 8f14b29e61aa73b27ac8389e8a02a0d8
- SHA1 078675252356a5bb7d6dc6e294e7ee6a16fd71d2
- SHA512 8fe990ccc7ea369112b2bd8b3f19ee24d297dbb5f9d7e2c79fd89fdf89f8cd5741f63933d95dee31acc6e2492aac61109311b030743068d574952c984841d5e7
- SSDEEP 12288:eP9HkdNJ0bFCuN1hNpoy6AUjqN4Tid1oNkDfibxOH:eP9HkHJ0bFLN1hNWkUjqN4TidaNymO
- TLSH T1E9948E52F1F2C032D4B3C9702D9B57A56FBAFE1018358D47A3D439CDA271692EA2631E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\7zS08FDFD5A\akelpad_setup.exe
- Size 1.2MB
- SHA256 ad63ea4048d68721701a3c0d2d9041a158e90789c7fc24526380607aad136aca
- MD5 0ac63da17f7003c1ad26906d0a72f4fd
- SHA1 339d723c3d19fd334a508b5148207bbdab0cfd5f
- SHA512 cc3633bd935774a741609bebe6d63368a273686f7ae704536d867e741559d5676dce92a6d826eafdc8441554326966d62962ced4e8809ee9a519a5c43cf6e3f3
- SSDEEP 24576:sqIJQXd7CUwcof6p2n/hhlGXZTIhnZNK335Yya78/d:AA7fofZnNSMCpfd
- TLSH T1E645334280E6C8BBCA95503116A7AB7BEBBCDF2647AB070B5752BF76F8743010681747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\ioSpecial.ini
- Size 644B
- SHA256 7bd3b09d76c1e40105a623f8db99c38ebe1e6a042fe7d609bd8796ee7d3ffc4c
- MD5 0a5e44208d11e4c9ccd012d8c28a198d
- SHA1 b7c7f9f57c7c3519c3330071c07b31ebe0977d69
- SHA512 a6e80b8cc87cc4b769165fb161c8df7d57a09e740224bcaed8efdc6764c459e1d2c5e2d21b2b09c2b16a32efc5bce9c87bfe6e837d3f6d3d0fa45901aa7e3a7c
- TLSH T1A6F07D8C4106431E04122196A6BB3F9127D01C24479976F4F5628D83D74DDD185ED6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\ioSpecial.ini
- Size 653B
- SHA256 faa9b184735995976d91c70e81aaa7a3361f34d2bb235c851b915647dcbb4ea4
- MD5 4bda7dd028633d07ab7a288ff15ea4e8
- SHA1 9022a8d24347ec6f145424c2d4fedf7e211582d7
- SHA512 13530faa793a0a0ad9da54331d2a326ccd1054e5937290a46b65441ade4bb0a8f32f0db00b5c90e1850dadec0028ba4564ee16f9ef1114eee14479e0a3fc6543
- TLSH T1B8F07D8C410A431F08222196A6BF3F9127D01C24879976F4F5628D83D74DDD685ED6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\nsy6E4F.tmp
- Size 1KB
- SHA256 6131274f1f6835d4e9d3d13cbf4065fc6fde95f4d218dc77066fc003a9fc4bc1
- MD5 219cfd4c4e0f8a3439cfd71dfa21b190
- SHA1 78960417806a32434f626596222fd2827cf9c70d
- SHA512 21823401b2fd606ef024d50a7e9dfeb385da6171b3e8799fe64a4c00e8ce18bde76fbfd196a8461710e8575488185223339ddea61815e96c8a693df608209a89
- TLSH T1CD210D89D142951E8430C1661CBBBDA9B3E02D240FC57DA4F36A2C43D78CCE658DD189
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\nsy6E4F.tmp
- Size 1KB
- SHA256 e712f3a0d804d0c612aa947dcabd8cfd862853a4fbe39d1475bbd3469d854c4d
- MD5 469da0a370f4fced8065eb9ab58b132b
- SHA1 61d9590c73856be169623069daae5d8076466379
- SHA512 3bebe28e2f81da4a632100b52613c1a68a44a0c2b2dc81f60bcbe561098994c5830bb1de7693aac5d9d71162f3cf7931421b0772fae6b4f59148319b5fc3a91a
- TLSH T16D217089C042915D8034C5A61C7FBD95B3E02D244FC97D94F3AE6C43938DCF694DD189
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\nsy6E4F.tmp
- Size 1KB
- SHA256 ef946e62d5a210fdfc911bc7e850d157e6695783fc3b3af81b124ce9150eff15
- MD5 60a2011b2954273d6f73e08639efb97b
- SHA1 c47f705b73ac9448ead06128c1a69416842eba0e
- SHA512 fcccf4b11351cec1681f44855491824ea47e89fa5794cdd4b7f5653fb1444a7630c818e309a0a79089932fc6f8a9e49a4e2e53db8f7b6612dfd45b03e67026e9
- TLSH T18D217089C043915E8034C5A61CBFBD95B3E02E244FC97D94F3AE2C43978DCE694DD189
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\nsy6E4F.tmp
- Size 1KB
- SHA256 cc983be39edbfddfaf88c3493a6b133413c12bbc001bdfb4b49f6c9a1aff3cb5
- MD5 3921927f2e51a75a8cdcb667c9e671ec
- SHA1 ea771ca2f847fbd0f6e971994c18795404f2ffee
- SHA512 5635a35d76d7535a9d3df24b0c4c20f3f56ca2827753d39d9ca17309f82d93ec34b65650db8d75424343e1428e9660a0493eea8b4785cc9d8d16da2153b795f0
- TLSH T183216E89C042915D8424C5A61CBFBD95B3E02E344BC96D94F3AE6C43978DCE694DD189
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsy6E4E.tmp\nsy6E4F.tmp
- Size 1KB
- SHA256 82f0ac7bc5b9a0078512dff332516e72461108472a0ad03909be1cb578d4fd39
- MD5 8d46d0f2fec3c9e8da0148084bff393e
- SHA1 9e73c3f36ee168ac7ba2d42389a267c84351b80f
- SHA512 eff24e305d7c3f6521138c76488793935f55c07b56e68212510142d91e913c3ca46a1c612e98fe2a16510eb38244718f7168f523289b177ef9b5f99db08f3b36
- TLSH T150210A89D182961E8430C1661CBBBDA9B3E02D240FC57DA4F36A2C43D78CCE658DD289
- MD5 SHA1 SHA512 TLSH