734b779be80e9ba05581411804d064792c6fd8395af12edf41671ace6aa93870

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
Size 986KB
Sample260808-fpmf2styc1
SHA256 734b779be80e9ba05581411804d064792c6fd8395af12edf41671ace6aa93870
MD5 3b4d6231fb9dccd77cc90a98531cc895
SHA1 d32fc195133c627bd8fe3d72b3e476aae8e91462
SHA512 f1d40140d2d50437ab14bed9b37c68d721c41b6e9ec5caccafcb49a9776f1196a72a35e9cde983efa8b273ab6c72f6bb92a11f68daac7d521d76d910eb1bea64
SSDEEP 24576:HaOOa3JPq5oUkIxqujKeT/Zvdp/Lrk6jBqmuN0bd:h7AoUkI4ujKeT/ZvTDrHjBqmu2bd
TLSH
T1E9255B217795C03AD6B216B098399BAA553EBC713B76CCCB63C47A6D48302D26E34737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 9 IoCs

pid	Process
3480	svchost.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
1784	svchost.exe
5048	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
1684	icsys.icn.exe
1344	explorer.exe
2084	spoolsv.exe
4684	svchost.exe
2484	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	svchost.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\svchost.exe	svchost.exe
File opened for modification	C:\Windows\svchost.exe	explorer.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1684	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1344	explorer.exe
4684	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
1684	icsys.icn.exe
1684	icsys.icn.exe
1344	explorer.exe
1344	explorer.exe
2084	spoolsv.exe
2084	spoolsv.exe
4684	svchost.exe
4684	svchost.exe
2484	spoolsv.exe
2484	spoolsv.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3480	4456	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe	86
PID 3480 wrote to memory of 3712	3480	svchost.exe	87
PID 3712 wrote to memory of 5048	3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe	89
PID 3712 wrote to memory of 1684	3712	2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe	90
PID 1684 wrote to memory of 1344	1684	icsys.icn.exe	91
PID 1344 wrote to memory of 2084	1344	explorer.exe	92
PID 2084 wrote to memory of 4684	2084	spoolsv.exe	93
PID 4684 wrote to memory of 2484	4684	svchost.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - \??\c:\users\admin\appdata\local\temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
      c:\users\admin\appdata\local\temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5048
  - - C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1684
    - - \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1344
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        7⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2484

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
Size 950KB
SHA256 f3a22dbafeaae43355f34ce263dc0f37894bfb36ffa4ca33687e10f6e1a701ef
MD5 7c095cbb8e968d60138b91309d19f8fb
SHA1 78dfe1b2bdeb869c2136258d9b93322532d0040c
SHA512 5233c6a06ff126af7f33d515709362a929f4e290e4f8b7fc06af6f81726f30f5b17b6e972eb39d212106acd8115597a8a1e74f5e0673c81e8f551b39d12a4edf
SSDEEP 24576:PFOabJPq5oUkIxqujKeT/Zvdp/Lrk6jBqmuN0w:tfAoUkI4ujKeT/ZvTDrHjBqmu2w
TLSH
T1F9255B127795C03AD6B216B098399BA9653ABC713F76DCCB63C47A2D48302D26E30737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_3b4d6231fb9dccd77cc90a98531cc895_amadey_cobalt-strike_elex_jeefo_luca-stealer_njrat_smoke-loader.exe
Size 815KB
SHA256 52db87dee0160a13cf51e31bee6320da09767582f1f359f8cf9a787d1228bf44
MD5 fee446a7a51556046a5979ef2e983182
SHA1 b13a3e2e666cbfee618a13025fb81759fbf41320
SHA512 2d767fff8c67418af355ba4766d3cd37b5672726276b82cb6474cd6083e43110f46921881b847f32e09a15a052d04fa03f1f8fe10a3c8a98db1790570c5bad23
SSDEEP 24576:YJPq5oUkIxqujKeT/Zvdp/Lrk6jBqmuN0x:YAoUkI4ujKeT/ZvTDrHjBqmu2x
TLSH
T1F9054911779AC039E6B226B099399BA6453EBC717B76DCCB23C4796D48306E15E30B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 fa70cfb3eaf6a59c6cac19e40e27e6a6f0e833daeae8b6702e80cd851dd41738
MD5 e14e10f06aeeecc702309445dc57f9d4
SHA1 bd95422d7a806af846eba79fc4adf78ad3f30871
SHA512 4e81a231bae23dcde05dd45f02d9e939f9826d33b976890fd8205fa8dd8b26e117831e4394e7f3415844fbdb7fd48293c6fb54712a28287c74792142e391c8d7
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVzN:UVqoCl/YgjxEufVU0TbTyDDalJN
TLSH
T1AED3F923BE10502ED866C5F228A9DA5FB6116E324FD06D4B73A6BB45357220BB1F121F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 702f1f91640842e12561b8f58d6b2470de1ffdd823dc4c61fd870803e8560f7d
MD5 6c37a0d9a8acf3eb38260d083aed62fb
SHA1 89da5cad15e17ceb4604becbd5732a8e7d5c93f5
SHA512 c06fe5a9a49a513767f31da8def7134226bd740c144e5ba1236a169f04ef0aeaae7f6f6bd7be16679a547015e11e7021591e6b65420434f9e22ec3e65c01feef
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVzITTTTTTTTTTTTZ:UVqoCl/YgjxEufVU0TbTyDDalJm
TLSH
T185D31823BE50803FD8258AF138A6D77DB9729D291BD46D0B7696BF0515B220376F420F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 d624ff0f6bc71f2c860b2590a733956e6619abd861307539fcb4b90dc48d7377
MD5 56a05fa2c97426dd306242c4dbc003e4
SHA1 a5314abd44bf5510e52f1dfd8fccc3698836767b
SHA512 db9447076a800109ee8b34048d4be01b6e75b9eb581377db4eb8db01b5e354c5fa17ccc5fc5f3dbbdaf15004e3fd740588bda793012750379019b6a8a5b38dde
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVzE:UVqoCl/YgjxEufVU0TbTyDDalJE
TLSH
T107D3E913FF14543DC49289F168A6DA6EF9255E2B4BA0AC4B73E2FB0025B150776F025F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 1ff99b9f42bbc64c7ce88979958160bb7fa47b784faa4adb0e4255a97683f52c
MD5 4e9e875c4f1c8ef99ec1c21da075a2e3
SHA1 513dbf25d7d0ff5e2744a9aad344b072144b5891
SHA512 6ee21c5f941da6821613b5899191f7c9162e5ca6650535fd231c571ceb3321a4b8df90369d413d830326617767213acc4c5d22198d28ea6cb6bad7111df32faf
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVzB:UVqoCl/YgjxEufVU0TbTyDDalJB
TLSH
T16CD30A236E90442EE45289F5BC59D72EBA220E355BE0BC5B3662BB5035BA70375F070F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\svchost.exe
Size 35KB
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
SSDEEP 768:tkOumaoDu3hAyN95/KTSZsOTb/Kc6H0anc6HEvT66vlm3GWBk5hr2C56r:SmaoDu3BN95/g4byc6H5c6HcT66vlm3j
TLSH
T122F2F72B5491EC7AC8A212F026BD0F26C376C9B0B854E58ADBC42D6B75A11D2F1B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-68-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1684-25-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1684-59-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/1784-61-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1784-76-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1784-73-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1784-66-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2084-58-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2484-57-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3480-11-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3712-60-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3712-9-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4456-3-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4684-70-0x0000000000400000-0x000000000041F000-memory.dmp

Download