a46fa7467e7aa23dd0171bb0b16d5f6be9d77353369c8d2f4663c63bde7cffe3

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_86e1756570e806aed6064d12176406eb_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Size 277KB
Sample260809-l2s29ayxdt
SHA256 a46fa7467e7aa23dd0171bb0b16d5f6be9d77353369c8d2f4663c63bde7cffe3
MD5 86e1756570e806aed6064d12176406eb
SHA1 21bc7cffc168ed6ad0310c3239ef6aa410c2a163
SHA512 4d9be999650eab78b778b602b000261eb921168b55af58e2378e9466be7dbe2f57eeca2bcd49f477f9d9d2fff258c94366f76f90d5808c12cb43d2ed779dc129
SSDEEP 6144:7IkaP3jc8p0a0Hh+dB+lrvIsWI1zd025Gr5iQayPvU5BRIb:7Ik6s1Ish3oZEM
TLSH
T177547D10BA42D132E562557256799BB7C93DAC705F2096CBE3C09EFDD9306C0AB38B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4472	3008	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_86e1756570e806aed6064d12176406eb_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_86e1756570e806aed6064d12176406eb_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_86e1756570e806aed6064d12176406eb_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 452
  2⤵
  - Program crash
  PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3008 -ip 3008
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads