Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/09/2026, 18:32
Behavioral task
behavioral1
Sample
2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe
- Size 2.5MB
- Sample260909-w63gla1yft
- SHA256 76613f1a9505ee222aa8e4f3a148cadf05cfbc5cefa8b8335c7d63908ad432d2
- MD5 689171c5efd6b8be9c9917ed5425fc16
- SHA1 f145ec92e72e7637fc9ce5d410035a609fcfc1c0
- SHA512 f72d122918bc1eae4d6a95b88a50b936c05e0c11b49fadc0cbe4848c25e0a7edbbe5186eacbde9cd7d422b1055c771947d761965ea3e1ab0563fcc2b4debeb04
- SSDEEP 24576:1IrBCvqVYAv8RDSQ5jcAkSYqyEh0Le5ji0hmxNrMR:fkYwWDNpYqBPji0Ajc
- TLSH T139C51701F6688221DC6E8D74C492A676F9313C8F7F3DB68B1E45B3282E776D19536322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\doskey.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\cmd.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\efsui.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\fc.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\more.com- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\chcp.com- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\net1.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\printui.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\raserver.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\userinit.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\recover.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe -
resource yara_rule behavioral2/memory/5144-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c4c3-5.dat upx behavioral2/memory/5144-816-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5144-2921-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Uninstall.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFaultSecure.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\desktopimgdownldr.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qappsrv.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\UtcDecoderHost.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.26100.1591_none_b89e4fe4764210cb\SIHClient.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\r\gpscript.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\rasautou.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\sethc.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\r\eudcedit.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_10.0.26100.1_none_cc283b8d55248fc5\Locator.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.26100.1150_none_8b65f13ba864c9e1\sysprep.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_b9d66d642921dc90\attrib.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_3498f416009e0fc9\MigRegDB.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_36c64bb72fffb46a\Dism.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adaminstall.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\winlogon.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.26100.1_none_200ace4b24b1d248\chkntfs.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\r\vmwp.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\r\FilePicker.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\showmount.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\r\RMActivate_isv.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\r\Narrator.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\r\dialer.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.26100.1_none_b3595e41e3c0336d\waitfor.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.26100.1_none_22104f68acb76d7f\VMImport.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15912.0_none_d8607d8709732f01\InstallUtil.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1150_none_9f6738de73cf4ce3\dpnsvr.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.26100.1591_none_435b2733e13c4689\r\dxgiadaptercache.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\findstr.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1150_none_39f7d4e8ce48dadd\nbtstat.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\r\SpaceAgent.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1742_none_0f4cbac5697cd3b6\r\LaunchWinApp.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1_none_2f0f4a8a2f528469\proquota.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\MuiUnattend.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\UserAccountControlSettings.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\r\win32calc.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_8f56b2193eadb75b\CertEnrollCtrl.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.26100.1150_none_17cfd41bb43a934d\WmsSelfHealingSvc.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_381c415a75a491aa\CloudNotifications.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\bootsect.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpupdate.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\FsIso.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\mofcomp.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1_none_6c5f8b350c999f6d\gpscript.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_4fd441a3f30753ec\replace.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.712_none_82c18832efd3e8d9\r\mmgaserver.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\r\omadmclient.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe- 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_689171c5efd6b8be9c9917ed5425fc16_amadey_cloudeye_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 3.4MB
- SHA256 20526024c528e0ca5e25b09189c83a2b1c5b77e8ede4d9d9918d836648565405
- MD5 cd9b25998ee4e7d103ce18aa63e4bbd0
- SHA1 ebf79cf53b71c570140636f0702b633cb6d9c6b4
- SHA512 166077dd92e46b85d598ba14d7a78ffd93d235eb45565ff4e2255b92e6e44989f5636336701ed59296b088d41247706f592ba0ceff24d749616c35253de8d798
- SSDEEP 49152:fkYwWDNpYqBPji0Ajt/ezSC6vUzPvMHjyc:fRDN6mjoBezSC6v2XMHJ
- TLSH T1C7F5D411B5688222DC7E8C75C5D2A679F9313C8F7F3CBA8B0E45B2282E376D19535722
- MD5 SHA1 SHA512 SSDEEP TLSH