Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 18:35
Behavioral task
behavioral1
Sample
2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
- Size 6.7MB
- Sample260802-w8a55avyfv
- SHA256 b8925a63ac96172f1d92695482fd2ac8e21267cd655930f384d460ddb2f146fd
- MD5 5433680938a913f9dbf2ac4176b7c7c0
- SHA1 9ff545f67c6f32db39216f9fff3cd36facb55dd8
- SHA512 8b6094bb69a2521477edcae817fc7f9a8af92408566ba6df2700fe3a7f8b8049e4c81e94023956fc7d77bcbebf87948b73bcd3c6dfae3dc13398549f2d3107e7
- SSDEEP 98304:0lB55D9LpUeUJF3noxDGtLK3BDhtvS0Hpe4zbpaAKQkL:0l35DppQ327BnvjeApaAvkL
- TLSH T18C66C04373F001F4D9668330C959A336E7B2BD5E5530EB0F27985B5A2F33B619A2A316
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\certutil.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe -
resource yara_rule behavioral1/memory/1544-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00070000000238c4-5.dat upx behavioral1/memory/1544-832-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1544-3216-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\r\sessionmsg.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\f\Win32WebViewHost.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\f\wordpad.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.19041.1_none_d1ffdc3927836528\WmsManager.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_6c221eaccd6c91ae\msinfo32.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_fb1129caa00e000f\msinfo32.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\dsdbutil.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.746_none_18520236ff9eab63\colorcpl.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.19041.1_none_d0dbd55ec26928c1\GenValObj.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.264_none_c813a1965bacf6d2\SystemSettingsBroker.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.19041.1_none_42154eff4d5817bf\easinvoker.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\UpgradeResultsUI.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\f\MusNotification.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.19041.1_none_e409500831824146\dxdiag.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_5c4f760174b23886\perfmon.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_476e348ff3b593af\cmdl32.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15805.0_none_aadf84cda75da02d\aspnet_regsql.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.1_none_a65e065ddcc839c0\ThumbnailExtractionHost.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_f4a55c2c3386ed90\f\UserAccountBroker.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fontview_31bf3856ad364e35_10.0.19041.1_none_04a9c5158a354e7a\fontview.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\SpeechRuntime.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVShNotify.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_33c3e07f6cce5a52\dpapimig.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseIR.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.19041.1_none_a99795d4c367fea1\RMActivate_isv.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\shrpubw.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_b93dce693a9c6db9\WinRTNetMUAHostServer.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\r\ApproveChildRequest.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\WmsSvc.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_16a30fa92fe5e343\srdelayed.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchIndexer.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\f\EoAExperiences.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.19041.1_none_c367e800917abc7d\odbcconf.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\PATHPING.EXE- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\unsecapp.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.19041.1_none_7b261299a50c8282\DFDWiz.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\f\cmd.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.1_none_fa9e6f40748daf14\colorcpl.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.19041.1_none_7aff9045397d4a4c\RdpSaUacHelper.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\f\hvix64.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1_none_8298e4b5b7fd2c26\iexplore.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.1_none_f4db83a870443aa2\CloudExperienceHostBroker.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\f\CustomInstallExec.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\r\eshell.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.84_none_9f3e49455f52d8f7\r\dxgiadaptercache.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_87b019d7cebd66d4\f\iissetup.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\f\smartscreen.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_9a152e76298cd801\r\wmlaunch.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15805.0_none_c6dc1994db088235\CasPol.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1_none_52c6583f47afba7a\autoconv.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpresult.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\usocoreworker.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15805.0_none_814c9c8a31da2279\aspnet_regiis.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\WmiPrvSE.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\f\PasswordOnWakeSettingFlyout.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.19041.1_none_8dec776522fcecde\wbemtest.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\Pester.bat- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\windeploy.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\r\SpatialAudioLicenseSrv.exe- 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_5433680938a913f9dbf2ac4176b7c7c0_elex_luca-stealer_njrat_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.2MB
- SHA256 45937f02ffa45071a8711cdf0fd8f825970cfd67265446e34cb11f74216f5d07
- MD5 d437c725cde9b33025227a89196963b1
- SHA1 fdf3f323bcb91151c3d5d96696329cd2a7cd1223
- SHA512 63717b76211547445b8a70d5608191dc532edc472f450c9b6051cd09bfff59b8da0b5fd4e256507c86bc51762bbfa13607f63e004b4fdf0df567b05ec8ce3056
- SSDEEP 98304:0lB55D9LpUeUJF3noxDGtLK3BDhtvS0Hpe4zbpaAKQkjjo6:0l35DppQ327BnvjeApaAvkHo6
- TLSH T10376B043B3F041F4D562C330C995A336EAB1BD495630EB4F279897592F33BA19A3A325
- MD5 SHA1 SHA512 SSDEEP TLSH