018ef28297ce741edb6f4895e831f581ac7fb4142557eb64624ab67eceb49851

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Size 26.1MB
Sample260811-2fx23stbpg
SHA256 018ef28297ce741edb6f4895e831f581ac7fb4142557eb64624ab67eceb49851
MD5 91a2228b0609302738a882920d4eedaa
SHA1 6a3bf111045cefac791c13ba3bbb9068b6ed7fa2
SHA512 637ce2adc3605d308d5f6b1b4215949b5fcfc293086b08bbf73cabe2d0b66aa4c2665581cd4c8881811f919793361ab35075e3e57a16c8d8a8838d4f1c7fba60
SSDEEP 49152:U+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eoi:WLZ1oULZ1oLp7z
TLSH
T144574B09F94340B1D92B50B04DCFD2BF8A60BB2587128DF7FB8DCB5B6923BA16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
252	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
6048	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
1880	svchost_BBBBCAAAACAABABCCBBBACBABCBCAACCCBCACBACBCCBCACABBBBABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAAACCBCABBAACCBCCACCACCCCBAAACBAAACBCABCCAACAABAACBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe"	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABBBCABBCBBACBCCBCABCACCCACCACAABCACACCACABAABCBBBCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCAAAACAABABCCBBBACBABCBCAACCCBCACBACBCCBCACABBBBABC.exe"	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2128	sc.exe
4452	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2980	cmd.exe
5608	cmd.exe
1812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCAAAACAABABCCBBBACBABCBCAACCCBCACBACBCCBCACABBBBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3392	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
3392	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
3392	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
3392	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
252	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
252	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
252	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
252	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
Token: SeDebugPrivilege	252	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 1812	3392	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	92
PID 1812 wrote to memory of 684	1812	cmd.exe	94
PID 3392 wrote to memory of 2980	3392	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	95
PID 2980 wrote to memory of 2128	2980	cmd.exe	97
PID 3392 wrote to memory of 5608	3392	2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe	98
PID 5608 wrote to memory of 4452	5608	cmd.exe	100
PID 252 wrote to memory of 1172	252	svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_91a2228b0609302738a882920d4eedaa_amadey_elex_luca-stealer_njrat_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAAABAAACCBABBBBBCAAABCABBCACBCACCBAAAABBBACCCBABBABCAAAAACAACCBBACBCBCCBBCCCCCABAABCAABABBBBCACBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAAAABAAACCBABBBBBCAAABCABBCACBCACCBAAAABBBACCCBABBABCAAAAACAACCBBACBCBCCBBCCCCCABAABCAABABBBBCACBCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAACBCBBBCAABBBABABCCCBABACBACBACBCBBCCCABCBBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe" start= auto displayName= "UserDataSvc_AACAACBCBBBCAABBBABABCCCBABACBACBACBCBBCCCABCBBAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACAACBCBBBCAABBBABABCCCBABACBACBACBCBBCCCABCBBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe" start= auto displayName= "UserDataSvc_AACAACBCBBBCAABBBABABCCCBABACBACBACBCBBCCCABCBBAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAACBCBBBCAABBBABABCCCBABACBACBACBCBBCCCABCBBAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACAACBCBBBCAABBBABABCCCBABACBACBACBCBBCCCABCBBAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAAAACAABABCCBBBACBABCBCAACCCBCACBACBCCBCACABBBBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCAAAACAABABCCBBBACBABCBCAACCCBCACBACBCCBCACABBBBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b309f8fa8e13203fa2c4202327bd44d7d2df136439e794d61c2cb3dc3dc825aa
MD5 35b54bdeee929d1f1bd5c39b725ea0a8
SHA1 bdcb70247873daaa5920b7bb8a8741e598ff5bab
SHA512 78c70d8680a7c3802ff601e4f54e370a1cbc8440ca450b12b9e0291848b6e65256b4995c4f74b0e1347146fccc168ceddd816b74499107527db392a2d9dcb550
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 864ae97ba5cbde2b61e668e5bb13f5a4e0f524223bcc56f27752d91bd686fbed
MD5 59561a605b3f880686ff6c276ca42c09
SHA1 28700995e58ffc2d68e61e59981563ae77ed27a0
SHA512 2709b1364fb3a8d921d7ac12f4d878623a8d43681909db41714e3618314b281dce75bc33c147ebac4abdd600943c4ddc11c56e966fbf955ad19461c4fdfa94da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eabde2a2ff6950217b3943b2274fc86e14e97fc5bebfab068272ccc2c80bfd09
MD5 19aea6913179d99904ca8568099b5dbe
SHA1 8366960bdd25d2b66c469dac92f6335e695960b9
SHA512 5578b98d69e3f024caa46d9fa13abd958e290668c8d3949c1b4d6309f87f06a972310e68477c155e39ba357dfd0886a174e9f177b79f0b77e2711330fdb1e730
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e71402019d9fc1baa8c32df79b8cdac5c811defdc7ae15a1fc445cde93caf34
MD5 4bb747460ce8830affcefd6fe8052aa8
SHA1 07fea2c327033d3050af8f9f766d3e1e122097c4
SHA512 4ce9ed95afd0bdcb173e4e655d14343982e14a0fa5407c8a00273ea2d52723ed88059f3b99bb3db30f9f26927a0db82652c760790ca328e38948b2f208e52149
MD5 SHA1 SHA512

Submit Download

svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBCABAABCCCBBCCABACCBCCCBCBBBACAAABCCABCACBBCCCCBCAA.exe
Size 26.1MB
SHA256 018ef28297ce741edb6f4895e831f581ac7fb4142557eb64624ab67eceb49851
MD5 91a2228b0609302738a882920d4eedaa
SHA1 6a3bf111045cefac791c13ba3bbb9068b6ed7fa2
SHA512 637ce2adc3605d308d5f6b1b4215949b5fcfc293086b08bbf73cabe2d0b66aa4c2665581cd4c8881811f919793361ab35075e3e57a16c8d8a8838d4f1c7fba60
SSDEEP 49152:U+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eoi:WLZ1oULZ1oLp7z
TLSH
T144574B09F94340B1D92B50B04DCFD2BF8A60BB2587128DF7FB8DCB5B6923BA16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-34-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/252-52-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/252-73-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3392-35-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3392-0-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3392-61-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3392-23-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3392-11-0x0000000000460000-0x0000000000481000-memory.dmp

Download