dc4fb1d6fdc301bfa403c17624269f6be2f8022be56300cd5a7d835b20b51e58

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_02181e3f743c5911cc3d0b94852a59ed_amadey_elex_hawkeye_luca-stealer_magniber_njrat_remcos_smoke-loader.exe
Size 1.2MB
Sample260805-cpy83awdrb
SHA256 dc4fb1d6fdc301bfa403c17624269f6be2f8022be56300cd5a7d835b20b51e58
MD5 02181e3f743c5911cc3d0b94852a59ed
SHA1 3e80160377c2a9748a7c40ac34618aa9e8f7459b
SHA512 dedb30e96f52ea340a56d1f1039d0a2e962af0d35673999d36a906edd0c3592dfde9558632bab6bc7cbb5cc5057707e0540d0cc8a36b4c3293fbc1dcb65e322a
SSDEEP 24576:L6zAZKFuq8X4FH0MyTpNjMlhlQ979mFaxE4T:L6EZSy4l0MyTIlhlQ9kFaxh
TLSH
T175556C60BE92A523C497D23C5F22C095C8256D100B9184E762D47E9E3E356F17AFCBEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4800	2128	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_02181e3f743c5911cc3d0b94852a59ed_amadey_elex_hawkeye_luca-stealer_magniber_njrat_remcos_smoke-loader.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2128	2026-08-05_02181e3f743c5911cc3d0b94852a59ed_amadey_elex_hawkeye_luca-stealer_magniber_njrat_remcos_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_02181e3f743c5911cc3d0b94852a59ed_amadey_elex_hawkeye_luca-stealer_magniber_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_02181e3f743c5911cc3d0b94852a59ed_amadey_elex_hawkeye_luca-stealer_magniber_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 604
  2⤵
  - Program crash
  PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2128 -ip 2128
1⤵
PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2128-0-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/2128-1-0x0000000000740000-0x0000000000742000-memory.dmp

Download

memory/2128-2-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/2128-3-0x0000000000400000-0x0000000000528000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads