Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 09:50
General
- Target 2026-08-08_9e22ebe2cf1e1d0fb120726d65232f7e_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
- Size 250KB
- Sample260808-lt45jsx1cy
- SHA256 0054c31380702a184a79c13b6b8931b9880f7e5c8959382f60c50490d7e7c2bc
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 23 IoCs
- Suspicious use of SendNotifyMessage 22 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_9e22ebe2cf1e1d0fb120726d65232f7e_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9e22ebe2cf1e1d0fb120726d65232f7e_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RemoveCopy.wvx"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/116-52-0x00007FFE09710000-0x00007FFE097F8000-memory.dmp
memory/116-9-0x00007FFE175C0000-0x00007FFE175D1000-memory.dmp
memory/116-6-0x00007FF7B9980000-0x00007FF7B9A78000-memory.dmp
memory/116-7-0x00007FFE17330000-0x00007FFE17364000-memory.dmp
memory/116-8-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/116-10-0x00007FFE16E10000-0x00007FFE16E29000-memory.dmp
memory/116-72-0x00007FFE0B710000-0x00007FFE0B721000-memory.dmp
memory/116-11-0x00007FFE16DE0000-0x00007FFE16E02000-memory.dmp
memory/116-71-0x00007FFE10C90000-0x00007FFE10CA1000-memory.dmp
memory/116-70-0x00007FFE16940000-0x00007FFE1695A000-memory.dmp
memory/116-69-0x00007FFE0B730000-0x00007FFE0B75D000-memory.dmp
memory/116-68-0x00007FFE10CB0000-0x00007FFE10CD6000-memory.dmp
memory/116-67-0x00007FFE16B20000-0x00007FFE16B38000-memory.dmp
memory/116-66-0x00007FFE11150000-0x00007FFE1117F000-memory.dmp
memory/116-65-0x00007FFE11180000-0x00007FFE111C1000-memory.dmp
memory/116-54-0x00007FFE09620000-0x00007FFE09703000-memory.dmp
memory/116-12-0x00007FFE16DB0000-0x00007FFE16DDB000-memory.dmp
memory/116-13-0x00007FFE09B80000-0x00007FFE09F10000-memory.dmp
memory/116-18-0x00007FFE16D90000-0x00007FFE16DA4000-memory.dmp
memory/116-19-0x00007FFE16B40000-0x00007FFE16B51000-memory.dmp
memory/116-20-0x00007FFE09AA0000-0x00007FFE09B72000-memory.dmp
memory/116-45-0x00007FFE09800000-0x00007FFE09A96000-memory.dmp
memory/1332-23-0x00007FFE16DE0000-0x00007FFE16E02000-memory.dmp
memory/1332-42-0x00007FFE09AA0000-0x00007FFE09B72000-memory.dmp
memory/1332-27-0x00007FFE16D90000-0x00007FFE16DA4000-memory.dmp
memory/1332-24-0x00007FFE16DB0000-0x00007FFE16DDB000-memory.dmp
memory/1332-25-0x00007FFE09B80000-0x00007FFE09F10000-memory.dmp
memory/1332-22-0x00007FFE16E10000-0x00007FFE16E29000-memory.dmp
memory/1332-44-0x00007FFE09800000-0x00007FFE09A96000-memory.dmp
memory/1332-21-0x00007FFE175C0000-0x00007FFE175D1000-memory.dmp
memory/1332-16-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/1332-15-0x00007FFE17330000-0x00007FFE17364000-memory.dmp
memory/1332-14-0x00007FF7B9980000-0x00007FF7B9A78000-memory.dmp
memory/1332-28-0x00007FFE16B40000-0x00007FFE16B51000-memory.dmp
memory/1880-38-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/1880-57-0x00007FFE16D90000-0x00007FFE16DA4000-memory.dmp
memory/1880-46-0x00007FFE175C0000-0x00007FFE175D1000-memory.dmp
memory/1880-47-0x00007FFE16E10000-0x00007FFE16E29000-memory.dmp
memory/1880-59-0x00007FFE09AA0000-0x00007FFE09B72000-memory.dmp
memory/1880-48-0x00007FFE16DE0000-0x00007FFE16E02000-memory.dmp
memory/1880-37-0x00007FFE17330000-0x00007FFE17364000-memory.dmp
memory/1880-49-0x00007FFE16DB0000-0x00007FFE16DDB000-memory.dmp
memory/1880-31-0x00007FF7B9980000-0x00007FF7B9A78000-memory.dmp
memory/1880-50-0x00007FFE09B80000-0x00007FFE09F10000-memory.dmp
memory/1880-58-0x00007FFE16B40000-0x00007FFE16B51000-memory.dmp
memory/2648-60-0x00007FFE175C0000-0x00007FFE175D1000-memory.dmp
memory/2648-61-0x00007FFE16E10000-0x00007FFE16E29000-memory.dmp
memory/2648-55-0x00007FFE17330000-0x00007FFE17364000-memory.dmp
memory/2648-53-0x00007FF7B9980000-0x00007FF7B9A78000-memory.dmp
memory/2648-56-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/2648-63-0x00007FFE16DB0000-0x00007FFE16DDB000-memory.dmp
memory/2648-62-0x00007FFE16DE0000-0x00007FFE16E02000-memory.dmp
memory/3688-17-0x00007FF7B9980000-0x00007FF7B9A78000-memory.dmp
memory/3972-34-0x00007FFE16DE0000-0x00007FFE16E02000-memory.dmp
memory/3972-26-0x00007FF7B9980000-0x00007FF7B9A78000-memory.dmp
memory/3972-35-0x00007FFE16DB0000-0x00007FFE16DDB000-memory.dmp
memory/3972-39-0x00007FFE16D90000-0x00007FFE16DA4000-memory.dmp
memory/3972-30-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/3972-0-0x00007FFE0AB0D000-0x00007FFE0AB0F000-memory.dmp
memory/3972-40-0x00007FFE16B40000-0x00007FFE16B51000-memory.dmp
memory/3972-41-0x00007FFE09AA0000-0x00007FFE09B72000-memory.dmp
memory/3972-33-0x00007FFE16E10000-0x00007FFE16E29000-memory.dmp
memory/3972-36-0x00007FFE09B80000-0x00007FFE09F10000-memory.dmp
memory/3972-5-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/3972-4-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/3972-3-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/3972-2-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp
memory/3972-32-0x00007FFE175C0000-0x00007FFE175D1000-memory.dmp
memory/3972-29-0x00007FFE17330000-0x00007FFE17364000-memory.dmp
memory/3972-1-0x00007FFE0A860000-0x00007FFE0AB16000-memory.dmp