Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 17:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe
- Size 2.3MB
- Sample260807-vla16sha32
- SHA256 c3554a048126981211ead8e390aead88ab4797de77b95c6a63ac75793abefac4
- MD5 e79141eae4718593d6beb430263c3c4d
- SHA1 68ab3675209cc0bccbc026f612f6080a5ab9c083
- SHA512 28214fe28b20008e974225421f87fcfb11d09459f81fa266b96209d6f1bde49f9dfd62167f75ccc5c362480684d840f1b594f19108a74ce40a09e09196927506
- SSDEEP 24576:/X/ajNHJFzWqNFb96H0+/DX/ajNHJFzWqNFb96H0+/VmBW0FL8I7OD3dr:SHJF7nMHCHJF7nMHhm9wZ
- TLSH T1FBB5190153624067E56534B4C06E77980668BFF02F67E1E7FE80359AFA31BC568336BA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4544 2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_e79141eae4718593d6beb430263c3c4d_amadey_elex_luca-stealer_njrat_nymaim_ramnit_redline-ste.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 4.5MB
- SHA256 0973eaac7ae136961d1a2b3b5de5ed12a7a0f8f111e75bb3ce8491f919ef014c
- MD5 8d6f74276f4da1af9ba7d5c11e400450
- SHA1 64f4123fe0e7a967e54b776db57b091e788de23e
- SHA512 8fea913fa0760023cca5015b8228c2986afdee021d92762ba45eed2e1fb644b677afb2d13c6d3580252463178bcea9f840d078d02c4d15a2330ed649e1349666
- SSDEEP 49152:SHJF7nMHCHJF7nMHhm9wgCbRquA/m2yL5zbfFiV+XenmE3/zc:Cjs7poq2Vjnmb
- TLSH T121266C05636080A2E1A195B4C1AAA745E3347EB41F32E6EFAE50354EBE33BD15D37336
- MD5 SHA1 SHA512 SSDEEP TLSH