9ce8c899fbd0e61bac99a474860b7414c0473319735f6a573eb2631dd01164ee

General

Target
2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
Size 631KB
Sample260802-pbct5ayzht
SHA256 9ce8c899fbd0e61bac99a474860b7414c0473319735f6a573eb2631dd01164ee
MD5 169c61bdf14b9c5485edff087abdb5e8
SHA1 16b868caab95841351d592f396c20a8e51644479
SHA512 0747132acb4bfcda89a7e8fc5c477300ab818ab076508a3eba22fe334db7454ba0d4c8cbdb6d53b2aac6500425263ba289154981609d998780af937f65d84f88
SSDEEP 12288:uEP6CTwNIu2sC3z0o0ARkV9lVbs9JoyxBlDetAqxSv+ke:diQw98310ARkblVeJoybGk
TLSH
T1B8D4C012B5A09076F17246358969EB519B7DBC700F2097CF63C405EA6E702D0AF37BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe

Executes dropped EXE 1 IoCs

pid	Process
4244	QeOV36tSqFiv.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4244	QeOV36tSqFiv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
4244	QeOV36tSqFiv.exe
4244	QeOV36tSqFiv.exe
4244	QeOV36tSqFiv.exe
4244	QeOV36tSqFiv.exe
4244	QeOV36tSqFiv.exe
4244	QeOV36tSqFiv.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 476	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	90
PID 2580 wrote to memory of 476	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	90
PID 2580 wrote to memory of 4724	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	93
PID 2580 wrote to memory of 4724	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	93
PID 2580 wrote to memory of 1128	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	96
PID 2580 wrote to memory of 1128	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	96
PID 2580 wrote to memory of 2996	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	100
PID 2580 wrote to memory of 2996	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	100
PID 2580 wrote to memory of 4244	2580	2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_169c61bdf14b9c5485edff087abdb5e8_amadey_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_stealc.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2996
- C:\Users\Admin\AppData\Local\QeOV36tSqFiv.exe
  "C:\Users\Admin\AppData\Local\QeOV36tSqFiv.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

3

T1552

Credentials In Files

2

T1552.001

Credentials in Registry

1

T1552.002

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

3

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BC03A751-4E2A-A47D-0E49-D2B576C1FA6D.txt

Path C:\ProgramData\BC03A751-4E2A-A47D-0E49-D2B576C1FA6D.txt
Size 64B
SHA256 bdd3859ad96a7da5642a695e133553083cffa33dbdabbd36e19d662b1aea1382
MD5 c106efca7e980e6b33c59ae40163831b
SHA1 ae7bb9b95a8136a7ab984177fd9c5c22979f3b44
SHA512 1b88536a2160efa8e33fbc9c17184e82ec9281243666dcca930c23f5a81cb9851f66afc57d92a86b9cbce5106d62e1e185d0a3bf7967366a203c0d12aaf5ab4e
TLSH
T1F5A00259D258421A23B3B78594516D055557D2A6564806005D09D9402D13B6BD791904
MD5 SHA1 SHA512 TLSH

Submit Download

QeOV36tSqFiv.exe

Path C:\Users\Admin\AppData\Local\QeOV36tSqFiv.exe
Size 4.0MB
SHA256 a5f8fbd3a1d2841a07bb47a65b5f47565e80bc444256fcfafc8af828925b65cc
MD5 82ab46a9ea4d122fa03ad3d9e5baf2e8
SHA1 e8387b5aaec6fe61baed7d4470d50d9a69f68b8a
SHA512 6e0eada4437a1f63b1b4bfde765764ac3a03afa9dba17edaddbc8652b8f46da46d23aae833456da4fc5d9e133a02f4f158d1cd522b231fb66a1fc00309c4cf86
SSDEEP 49152:8nq+IEoJ/unUyZE4ICy/xVG98i4QCLsLGrfDL:8Z5vE5s9YhLDL
TLSH
T10B169E036D9148F9C09AA73988B35615BB74B8084B3177EB2E61BEB93F723D05E31764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2580-2-0x0000000003950000-0x0000000003A17000-memory.dmp

Download

memory/2580-3-0x0000000003A20000-0x0000000003DC1000-memory.dmp

Download

memory/2580-4-0x0000000003F00000-0x0000000003FA7000-memory.dmp

Download

memory/4244-39-0x0000000410000000-0x000000041023B000-memory.dmp

Download

memory/4244-42-0x0000000410000000-0x000000041023B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads