f98e86213ed13cbbcee4af0cdee3757708af235f37ff83c883a117c307f8ad35

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.0MB
Sample260816-clarasxfpg
SHA256 f98e86213ed13cbbcee4af0cdee3757708af235f37ff83c883a117c307f8ad35
MD5 7e84e8fe804bf013c881099f0cdc176c
SHA1 f12c1bc69931bb4372d1ddbaf278838b834ae673
SHA512 642e606a37e6ee058df98cd9c6d4dbb421385027cdc505d928902f9636a78ed781cdaf45667ef5ed7098bbc66b7bb952747b723025394311cd80b39a908b48b2
SSDEEP 24576:7G/Wem1gXq5L9uSWidgpm6hbpOSRKQ3wqycitCy/heuF8Orv4GLtPUf/2YQkd:7kXq5L9uiibpJKQov1zlUf/2a
TLSH
T115A56B0DA761512CFDF305FA4AFE23ACA82CBDA0075894D352C42ADED725AE57D32613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
defense_evasion

Executes dropped EXE 5 IoCs

pid	Process
5724	elevation_service.exe
2228	elevation_service.exe
5736	maintenanceservice.exe
5940	OSE.EXE
5456	ssh-agent.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3797332335-34111092-3597280141-1000\EnableNotifications = "0"	elevation_service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3797332335-34111092-3597280141-1000	elevation_service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\V:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\G:	elevation_service.exe
File opened (read-only)	\??\O:	elevation_service.exe
File opened (read-only)	\??\Q:	elevation_service.exe
File opened (read-only)	\??\S:	elevation_service.exe
File opened (read-only)	\??\I:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\U:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\W:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\D:	elevation_service.exe
File opened (read-only)	\??\J:	elevation_service.exe
File opened (read-only)	\??\L:	elevation_service.exe
File opened (read-only)	\??\R:	elevation_service.exe
File opened (read-only)	\??\T:	elevation_service.exe
File opened (read-only)	\??\S:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\T:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\X:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\W:	elevation_service.exe
File opened (read-only)	\??\H:	elevation_service.exe
File opened (read-only)	\??\M:	elevation_service.exe
File opened (read-only)	\??\X:	elevation_service.exe
File opened (read-only)	\??\Z:	elevation_service.exe
File opened (read-only)	\??\D:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\P:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\V:	elevation_service.exe
File opened (read-only)	\??\G:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\J:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\M:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Z:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\N:	elevation_service.exe
File opened (read-only)	\??\H:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Q:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\R:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\I:	elevation_service.exe
File opened (read-only)	\??\K:	elevation_service.exe
File opened (read-only)	\??\P:	elevation_service.exe
File opened (read-only)	\??\O:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Y:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\U:	elevation_service.exe
File opened (read-only)	\??\Y:	elevation_service.exe
File opened (read-only)	\??\K:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\L:	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\openssh\qadaeqaq.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\alg.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\gameinputsvc.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\bpjdfemm.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\pchbdnmh.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	elevation_service.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\jjjoolof.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\refsdedupsvc.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\bmdnpqdi.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\gameinputsvc.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\ookloddc.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\alg.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\locator.exe	elevation_service.exe
File created	\??\c:\windows\system32\beppmcgd.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\lpjhfgfn.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrm\sgrmbroker.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sgrm\sgrmbroker.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\mahjhchh.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\locator.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\gameinputsvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\SysWOW64\hlkgkbob.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\refsdedupsvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\jiianoje.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File created	C:\Program Files\Java\jdk-1.8\bin\khigbmnb.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\finbkiei.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\fcbnjplg.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\edbponjd.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pnqggbpc.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\amhadgcp.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files\windows defender Advanced threat protection\mssense.exe	elevation_service.exe
File created	C:\Program Files\Java\jdk-1.8\bin\aneiiahc.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\bmmoojdm.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\mcfbcncj.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\7-Zip\afaqkaok.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\nnknaeep.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\qfemblig.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\inkghfkp.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files\windows defender Advanced threat protection\mssense.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\program files\windows defender\hqilbjei.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\knqknjlo.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\eehkqlfa.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\pbjmkqlg.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File created	C:\Program Files\Google\Chrome\Application\bhlnifll.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\nikalpei.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jhffffnb.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\akaajeom.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\gmoggjie.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\ooqkhhjo.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files\windows media player\wmpnetwk.exe	elevation_service.exe
File created	C:\Program Files\Java\jre-1.8\bin\fcmpdicp.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\bhomijhh.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ghdhglfd.tmp	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	elevation_service.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe
5724	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4608	2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	5724	elevation_service.exe

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_7e84e8fe804bf013c881099f0cdc176c_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2228

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7c219d2867462a62b7a534fef374a65b6ba8251a256b7f52809c144bd1c09ba2
MD5 61fbcda60d13b2064f64719a153cb16d
SHA1 38dcb5fb726c8a2c3863a7d6601f3c8f6afb370c
SHA512 4dc105c8352f628266c01bebb6ca5fbe004ade132902bb1f28ba231aecd09b54204956d054fbef180fe5abae86b095a5953169af29116c4e982fcd964161f022
SSDEEP 49152:Sb+632BuPkFKRrdE6ohMstBhuXjfS4LWxn8vJkxYIZW0OPUZv/:03q6tjBkZGPUZ
TLSH
T148D57C13EACA40E8D06ED078C7469533EA617C490B21B6EF0741B25A2E77EE85F3D758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 838KB
SHA256 9b28aa1d70dc1c25a7fa3fe256c1acc0635834ca3f9090d0339ae12817ef7e54
MD5 8acaf9eaaa02e4a8b832441b15a0f1e7
SHA1 b80241d581ef5e72eca149f9fc5f9af75ac0856a
SHA512 2d0370783488f7049733ada3b40d3d77fb09007da12cd8fbcb0da2a6918ec2a91efa8e6b36dab002f7fe1e8e4d4df14831bb20b6b4cb5a5a782752f586404573
SSDEEP 24576:TXYfDtczAVNzBHGSc9i9pLg7UVd31CCUuvL+VBuLCOhfc+ZPp:2tcIBHGWr1CCMBI0+lp
TLSH
T19B05A017A39100F9DA1BB338842245A2D53774F087FB5079B6D4A3960DAB347EBAB3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 817KB
SHA256 bddf6e020d10711482637ef7cdffd05af6d5caa813c6a6448fa4c552bab14be0
MD5 f340e12b2f6f923b562ee1b0994b44c1
SHA1 f0ff316a227aa6634dd95766578e8e732a076d8d
SHA512 e0004819b321931a2c1c43102fe19f15e214bd4f300b4faa0cdcdc03f7530b343e11ea2cd59bd0c41c78d26697378b7e3134539df29a930d6817b7edbace75aa
SSDEEP 24576:0wu2OWF1c6kiU+pOnFG4hdpbcrrLTAwl2c3:0wBOQ1c6ki6F2fTAwwc
TLSH
T16B059ECD69ECF7DCE968807A85E2277657FA78323C16960E326415C58A23371B4E07B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emdpmifb.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\emdpmifb.tmp
Size 6.6MB
SHA256 2facbfe5fa068fea17538a746db361597748ad114f6d7d97a1a1e6ddccc4357f
MD5 78bbca43253c14d095bf93ba1ffd80ec
SHA1 4a975a1293ce914fde1b7bd039dd4cd6d232c136
SHA512 5005259ac4b42de9f6b94fc21daf307f7c8049ce4fa08a793c072f9f19c8148d36a9a3da4286220ab7cc1c2845e9bd1686e81e53902f9fb774caa2934c5948f4
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Uf:RQRQyi36YOcPDLvw2gAf+PN31uvmogJ
TLSH
T104667C03F3A541E8E05ED9B4CF3956229B357C4A8BF192EF259436E11A72DD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f2e19cd5314fdcc261495c9926a87177dbb836c5a5d16682c4a13533ac6dbb70
MD5 2305ad11a2354e08520b1c7944cf46c9
SHA1 4442dfc70f977cf365dc7006cc63e838b9d9f25a
SHA512 70b9d2a74677a8db03acd8b57c70b13af8aaae20440a1e48248a54361eb0f8505004a53df13de24bdc677d93f611190274a9e357b3f289279157e60ce4d132eb
SSDEEP 49152:EB+taZ3usBWOBr4tEG/0bqx0z+n217aau1gl/aTzpdc:eu6JmJxd2dsT
TLSH
T1CFD59C17F29901D8F15DE4B84B4A9632E961BCCB0F2467DF1A4077122A7AEF4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9c5d757d84017e995b9c89d9df51c22cb23d99116f4a8db1942541bba906a26d
MD5 23993b737f22a4aab9f971e1f0ff5ae6
SHA1 a47f0c07f7259cf3610208e3272b2ba260a260de
SHA512 02b60f566aa1b21e2f6bcb832a26a6eb7d2319f4ad29f7ca8992fc9f592824e49d1b20df9dbfe7231b27359f809584be80bfb919f7718cebfd57fb6d8e21007b
SSDEEP 24576:iG88u8FpJqH1Fzria7/mjBMOKJpvrUSnoDN/YGgS5UACZykG:57ZFPqV8a7/prvriaGgSsyk
TLSH
T1F535BF24F2C581E7CBAA907D16BE82D7E1E270504378FFDF0210A9612ED17F96939B49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-14-0x0000000140000000-0x00000001404C7000-memory.dmp

Download

memory/2228-92-0x0000000140000000-0x00000001404C7000-memory.dmp

Download

memory/4608-1-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/4608-0-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/5456-46-0x0000000140000000-0x0000000140331000-memory.dmp

Download

memory/5456-109-0x0000000140000000-0x0000000140331000-memory.dmp

Download

memory/5724-91-0x0000000140000000-0x00000001404DD000-memory.dmp

Download

memory/5724-9-0x0000000140000000-0x00000001404DD000-memory.dmp

Download

memory/5736-33-0x0000000140000000-0x00000001402C8000-memory.dmp

Download

memory/5736-19-0x0000000140000000-0x00000001402C8000-memory.dmp

Download

memory/5940-35-0x0000000140000000-0x00000001402C2000-memory.dmp

Download

memory/5940-108-0x0000000140000000-0x00000001402C2000-memory.dmp

Download