Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 14:36
Behavioral task
behavioral1
Sample
2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
- Size 1.5MB
- Sample260825-ryrmxatdna
- SHA256 9c5f94c10b73c2410a43020c9a3515fe9962e923063f0528ba376e3c99c44eb2
- MD5 427ca7cd66c2f84b5d762bc88074fc6a
- SHA1 06246c294285c2b8cde82a889ed2b3bf4b7c11bd
- SHA512 56f25cf7eb89616537649e91211f8aaff5e7ace62e4a3e07156163069c049c455a28e4517ef6676ddf98be8581dc2e59bec34803e8fa99e684e32d5dfda0e5da
- SSDEEP 12288:1IrBCCFZolqkJ+YAvKbGTIFUjD5aZTrjEUXDIaTrjSNSx:1IrBCvqVYAv8RDSwx
- TLSH T188752901BA9840A1DC6E0F309961B631FD35BCAFBD1E760E2F44772E1AB76C07925267
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sdchange.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\help.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\label.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe -
resource yara_rule behavioral2/memory/1452-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001b1e8-5.dat upx behavioral2/memory/1452-1031-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1452-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\runexehelper.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\psr.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\CustomInstallExec.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingSvc.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\Magnify.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1150_none_066fd0a833dca900\provlaunch.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\rstrui.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15912.0_none_65c6ab619fd35783\WsatConfig.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\_isdel.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\NETSTAT.EXE- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1150_none_c83b3d886b00dded\ieinstal.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_8b784347184cb631\BackgroundTransferHost.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\unlodctr.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.26100.1_none_136be58c8b89053d\sihost.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\bfsvc.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_fd3d350bee0e4f11\r\bcdboot.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\r\mcbuilder.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_b60058d9621fad85\wscadminui.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgusr.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\r\w32tm.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_823d5f8eb617914a\userinit.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\r\LiveCaptions.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.26100.1150_none_e129c29cb0451e37\BioIso.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1_none_d5026185bf17c56a\Windows.WARP.JITService.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\r\csvde.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.26100.1591_none_50ccbceb26d74098\fhmanagew.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\UtcDecoderHost.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\Win32WebViewHost.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuauclt.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\comp.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\x86_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_b800bbe6c459021b\csc.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\dcdiag.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\sethc.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_2d66dab1a4ca9883\SystemPropertiesComputerName.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\TieringEngineService.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-keyscan.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmdiag.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.26100.1591_none_cfa6fd46757cb5b5\dwm.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\perfmon.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\EaseOfAccessDialog.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\r\MuiUnattend.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellhost_31bf3856ad364e35_10.0.26100.1591_none_e7ad5a201ddffac9\ShellHost.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.26100.1_none_46c1c0aa0704aa24\RegSvcs.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\r\SpatialAudioLicenseSrv.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1_none_4f21a8f907d2e489\sxstrace.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\CameraBarcodeScannerPreview.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\nfsclnt.exe- 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_427ca7cd66c2f84b5d762bc88074fc6a_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.5MB
- SHA256 1c288e377ae315bee526bfae353ef52a6ce952ee5116ae39a40babe71b9e31ae
- MD5 6ee0a6cfad7ea2f8ce21884707fd164b
- SHA1 950ed4fa73cce0994d9d34068670070034e0dbe1
- SHA512 6130af9c30aeb15a7a4e4e0a2ed32f7d8c8efaf083c798805e3c64e9a30e242bdc1a90abd39c76457da412753e00a7a9a6c016ca0f3134a5e94534edcc731221
- SSDEEP 24576:1IrBCvqVYAv8RDSwHa7/ezSC6vUyD/aqgrvWx6q8wyua:fkYwWDE/ezSC6vUzPvMHjyp
- TLSH T150C5F601B5688222DCBE8D75C492AA75FD313C8F7F2CB98B1E05B3282E376D19535726
- MD5 SHA1 SHA512 SSDEEP TLSH