Analysis
- max time kernel
142s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 03:29
General
- Target 2026-08-16_e6cb91c744078868f1e99c443f465c2c_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
- Size 787KB
- Sample260816-d2a8facl7w
- SHA256 c681007f3e4d625cdada67a8e0eb45505be137b74c674e9709c2e948b26a7afd
Malware Config
Signatures
- Executes dropped EXE 16 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_e6cb91c744078868f1e99c443f465c2c_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e6cb91c744078868f1e99c443f465c2c_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/936-15-0x00007FF6E17D0000-0x00007FF6E18F3000-memory.dmp
memory/936-63-0x00007FF6E17D0000-0x00007FF6E18F3000-memory.dmp
memory/936-16-0x000001F9BA340000-0x000001F9BA3A6000-memory.dmp
memory/936-17-0x000001F9BA340000-0x000001F9BA3A6000-memory.dmp
memory/936-18-0x000001F9BA340000-0x000001F9BA3A6000-memory.dmp
memory/1120-367-0x00007FF778E80000-0x00007FF778F2E000-memory.dmp
memory/1120-292-0x00007FF778E80000-0x00007FF778F2E000-memory.dmp
memory/1120-293-0x000002DE57550000-0x000002DE575B6000-memory.dmp
memory/1120-294-0x000002DE57550000-0x000002DE575B6000-memory.dmp
memory/1404-332-0x0000029C1EBC0000-0x0000029C1EC26000-memory.dmp
memory/1404-331-0x0000029C1EBC0000-0x0000029C1EC26000-memory.dmp
memory/1404-336-0x00007FF71D180000-0x00007FF71D315000-memory.dmp
memory/1404-389-0x00007FF71D180000-0x00007FF71D315000-memory.dmp
memory/2144-251-0x00007FF7F5780000-0x00007FF7F589A000-memory.dmp
memory/2144-253-0x0000021157AD0000-0x0000021157B36000-memory.dmp
memory/2144-330-0x00007FF7F5780000-0x00007FF7F589A000-memory.dmp
memory/2144-252-0x0000021157AD0000-0x0000021157B36000-memory.dmp
memory/2248-322-0x00007FF681E80000-0x00007FF682266000-memory.dmp
memory/2248-323-0x0000024B17CA0000-0x0000024B17D06000-memory.dmp
memory/2248-381-0x00007FF681E80000-0x00007FF682266000-memory.dmp
memory/2248-324-0x0000024B17CA0000-0x0000024B17D06000-memory.dmp
memory/2860-371-0x00007FF73BF80000-0x00007FF73C487000-memory.dmp
memory/2860-370-0x000001EB4E820000-0x000001EB4E886000-memory.dmp
memory/2860-372-0x000001EB4E820000-0x000001EB4E886000-memory.dmp
memory/2960-1-0x00000000032C0000-0x0000000003329000-memory.dmp
memory/2960-0-0x0000000003370000-0x0000000003466000-memory.dmp
memory/2960-7-0x00000000032C0000-0x0000000003329000-memory.dmp
memory/2960-6-0x00000000032C0000-0x0000000003329000-memory.dmp
memory/3024-382-0x00007FF79AED0000-0x00007FF79AFFF000-memory.dmp
memory/3024-383-0x0000027240EF0000-0x0000027240F56000-memory.dmp
memory/3024-384-0x0000027240EF0000-0x0000027240F56000-memory.dmp
memory/3136-263-0x00007FF739980000-0x00007FF739ACA000-memory.dmp
memory/3136-339-0x00007FF739980000-0x00007FF739ACA000-memory.dmp
memory/3136-266-0x000001A5BDEE0000-0x000001A5BDF46000-memory.dmp
memory/3136-265-0x000001A5BDEE0000-0x000001A5BDF46000-memory.dmp
memory/3248-54-0x00007FF783C60000-0x00007FF783DC8000-memory.dmp
memory/3248-46-0x0000022268E70000-0x0000022268ED6000-memory.dmp
memory/3248-52-0x0000022268E70000-0x0000022268ED6000-memory.dmp
memory/3248-47-0x0000022268E70000-0x0000022268ED6000-memory.dmp
memory/3248-45-0x00007FF783C60000-0x00007FF783DC8000-memory.dmp
memory/3260-360-0x00007FF67E320000-0x00007FF67EA64000-memory.dmp
memory/3260-289-0x00007FF67E320000-0x00007FF67EA64000-memory.dmp
memory/3260-285-0x0000027CB33A0000-0x0000027CB3406000-memory.dmp
memory/3260-284-0x0000027CB33A0000-0x0000027CB3406000-memory.dmp
memory/3368-346-0x00000242C2B30000-0x00000242C2B96000-memory.dmp
memory/3368-340-0x00007FF674FF0000-0x00007FF675311000-memory.dmp
memory/3368-349-0x00007FF674FF0000-0x00007FF675311000-memory.dmp
memory/3368-341-0x00000242C2B30000-0x00000242C2B96000-memory.dmp
memory/3368-342-0x00000242C2B30000-0x00000242C2B96000-memory.dmp
memory/3596-37-0x000001D5B9780000-0x000001D5B9833000-memory.dmp
memory/3596-38-0x000001D5B9960000-0x000001D5B99C6000-memory.dmp
memory/3596-39-0x000001D5B9960000-0x000001D5B99C6000-memory.dmp
memory/4240-376-0x00007FF70DB30000-0x00007FF70DF47000-memory.dmp
memory/4240-301-0x000001191E310000-0x000001191E376000-memory.dmp
memory/4240-303-0x00007FF70DB30000-0x00007FF70DF47000-memory.dmp
memory/4240-302-0x000001191E310000-0x000001191E376000-memory.dmp
memory/4616-29-0x000001FDDB740000-0x000001FDDB7A6000-memory.dmp
memory/4616-28-0x000001FDDB4F0000-0x000001FDDB5A3000-memory.dmp
memory/4616-31-0x000001FDDB740000-0x000001FDDB7A6000-memory.dmp
memory/4616-30-0x000001FDDB740000-0x000001FDDB7A6000-memory.dmp
memory/4916-59-0x000001B506CC0000-0x000001B506D26000-memory.dmp
memory/4916-57-0x000001B506A80000-0x000001B506B33000-memory.dmp
memory/4916-58-0x000001B506CC0000-0x000001B506D26000-memory.dmp
memory/5008-352-0x00007FF74DD60000-0x00007FF74DFEB000-memory.dmp
memory/5008-353-0x00000250BC690000-0x00000250BC6F6000-memory.dmp
memory/5008-354-0x00000250BC690000-0x00000250BC6F6000-memory.dmp
memory/5076-361-0x000001A45E440000-0x000001A45E4A6000-memory.dmp
memory/5076-362-0x00007FF7A37F0000-0x00007FF7A3CC1000-memory.dmp
memory/5076-363-0x000001A45E440000-0x000001A45E4A6000-memory.dmp
memory/5220-311-0x00007FF6406C0000-0x00007FF640774000-memory.dmp
memory/5220-313-0x000001AD5A120000-0x000001AD5A186000-memory.dmp
memory/5220-379-0x00007FF6406C0000-0x00007FF640774000-memory.dmp
memory/5220-312-0x000001AD5A120000-0x000001AD5A186000-memory.dmp
memory/5408-394-0x00000262FE160000-0x00000262FE1C6000-memory.dmp
memory/5408-393-0x00007FF741FA0000-0x00007FF7422DF000-memory.dmp
memory/5408-392-0x00000262FE160000-0x00000262FE1C6000-memory.dmp
memory/5720-236-0x0000021B361B0000-0x0000021B36216000-memory.dmp
memory/5720-234-0x00007FF7DAD70000-0x00007FF7DAE39000-memory.dmp
memory/5720-235-0x0000021B361B0000-0x0000021B36216000-memory.dmp
memory/5720-310-0x00007FF7DAD70000-0x00007FF7DAE39000-memory.dmp
memory/5916-351-0x0000000000400000-0x000000000054A000-memory.dmp
memory/5916-272-0x0000000000400000-0x000000000054A000-memory.dmp
memory/5916-279-0x0000000000A40000-0x0000000000AA9000-memory.dmp
memory/5916-273-0x0000000000A40000-0x0000000000AA9000-memory.dmp
memory/5992-244-0x0000023048820000-0x0000023048886000-memory.dmp
memory/5992-245-0x0000023048820000-0x0000023048886000-memory.dmp
memory/5992-320-0x00007FF7DAD70000-0x00007FF7DAE39000-memory.dmp
memory/5992-243-0x00007FF7DAD70000-0x00007FF7DAE39000-memory.dmp