7f2a1519f3d11e832b7b15881dc771194b2c9acb9ccacb16cede00e0975cd872

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Size 2.0MB
Sample260910-x5whbsfr4x
SHA256 7f2a1519f3d11e832b7b15881dc771194b2c9acb9ccacb16cede00e0975cd872
MD5 1b755409c0adbc3daf3699900f2cbd72
SHA1 540cc18b9d181d87f06aa0586bebd705a29da38c
SHA512 4319b1b6c09f41c10061d0393cfe14fef3c323631b0be58c5f80875e7f371a88ed5b114deb5906a07a5d043f4d04083e066fe35d07addc1313e67f13148329cc
SSDEEP 24576:rGcWem1gXq5L9uSWidgpm6hbpOSRKQxC7iIFhW4wcGn0uy0xYN7PzMuG5MLPWzUf:rTXq5L9uiibpJKQxgYX2ZGP
TLSH
T1BDA56C1DB761502CFDF305FA8AFE23ACA82CB9A0075890D352C416DED725AE57C36663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Disables taskbar notifications via registry modification
defense_evasion

Executes dropped EXE 6 IoCs

pid	Process
2468	elevation_service.exe
1272	elevation_service.exe
728	maintenanceservice.exe
3428	OSE.EXE
3836	ssh-agent.exe
4680	AgentService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3986082593-3624157295-3514260330-1000	elevation_service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3986082593-3624157295-3514260330-1000\EnableNotifications = "0"	elevation_service.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	elevation_service.exe
File opened (read-only)	\??\N:	elevation_service.exe
File opened (read-only)	\??\K:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\N:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\D:	elevation_service.exe
File opened (read-only)	\??\L:	elevation_service.exe
File opened (read-only)	\??\P:	elevation_service.exe
File opened (read-only)	\??\W:	elevation_service.exe
File opened (read-only)	\??\X:	elevation_service.exe
File opened (read-only)	\??\Y:	elevation_service.exe
File opened (read-only)	\??\H:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\P:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\M:	elevation_service.exe
File opened (read-only)	\??\S:	elevation_service.exe
File opened (read-only)	\??\U:	elevation_service.exe
File opened (read-only)	\??\Z:	elevation_service.exe
File opened (read-only)	\??\G:	elevation_service.exe
File opened (read-only)	\??\Q:	elevation_service.exe
File opened (read-only)	\??\T:	elevation_service.exe
File opened (read-only)	\??\J:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\T:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\J:	elevation_service.exe
File opened (read-only)	\??\M:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\V:	elevation_service.exe
File opened (read-only)	\??\D:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\R:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\W:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\K:	elevation_service.exe
File opened (read-only)	\??\O:	elevation_service.exe
File opened (read-only)	\??\G:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\I:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\L:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\S:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\V:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\X:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\R:	elevation_service.exe
File opened (read-only)	\??\O:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Q:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\U:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Y:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\Z:	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\H:	elevation_service.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\locator.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\locator.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\sgrm\sgrmbroker.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\gameinputsvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\bgeaiqgl.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\refsdedupsvc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	\??\c:\windows\syswow64\perfhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\sgrm\sgrmbroker.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\mdpmopgj.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vds.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\refsdedupsvc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\mkcbdklo.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\refsdedupsvc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\jicfkobg.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\jmojncbe.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\windows\system32\dqncbgkh.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	elevation_service.exe
File opened for modification	\??\c:\windows\system32\gameinputsvc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\hpbanfjo.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\eajefjjm.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jhffffnb.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\nnknaeep.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ogogbdbj.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\aneiiahc.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\qqlagjep.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\ooqkhhjo.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\finbkiei.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	\??\c:\program files\windows defender\fmicngng.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\gdaoemja.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\aglddoil.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\djgnqiea.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\aplfnjfi.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\elaqljie.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files\windows defender\nissrv.exe	elevation_service.exe
File created	C:\Program Files\Internet Explorer\llopmkim.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\gmoggjie.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\bfdecmqe.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\lojnilhp.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\gnciljmn.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\hbifodpe.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\eiknqqhf.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\program files (x86)\google\googleupdater\141.0.7340.0\updater.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ookbgdam.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\hfopahfc.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\gelfoimp.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\fhkccgam.tmp	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	elevation_service.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe
1272	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5768	2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	4680	AgentService.exe
Token: SeTakeOwnershipPrivilege	1272	elevation_service.exe

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	elevation_service.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	elevation_service.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_1b755409c0adbc3daf3699900f2cbd72_amadey_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5768

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:728

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8209de620fe68aa13e16245deaa78888ffb54eedee0d26c46c1c93c038eedefb
MD5 40ce1682e0623e91a68e7ac4503ba5b9
SHA1 91a9064cf5c1d3cdedcc0e9a20ef7a1795dc2027
SHA512 9161c7d90f477224635511dc1bb0d3f8edd0d70aa007319a2f79395f20b943d6bf1f0c8f520f2d8d3bf48844508929d561583d74054e63cd269c0087c2899813
SSDEEP 49152:yb+632BuPkFKRrdE6oh+stBhuXjfS4LWxnXe2Ed:U3q6/jBCz
TLSH
T1C4D58C03EA9D00E8E05AE1BC9306D12AE961BC991B2576DF0380B2551EB7FE75F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 842KB
SHA256 69659497a144d544c72aae5836562d50586a48e1bb3c874a1f80af2b556e0ab7
MD5 aa437ddca0213d661f633fb6e19ec92f
SHA1 2acb9213cefdcd5b76d5378d4c3fc75efd20cb8e
SHA512 ecf8ca3505c032f05f305b206488c2b8660f3826bf0d4b4aee3b23d4c1850457e9bc74508b7b181495df384b047df149205d9455da9840dd7a8ccff15970ca29
SSDEEP 12288:O1XLsswWkxy2lRq2czAYv+/iEQWiM+zOZ8Pc39dUvdmLwCksWlA9KFlpvy8TemJs:8XYfDtczAB/iERiLOK9tTmh08maO
TLSH
T1B705AE1828A40DA4E97255F05657284943BE3708B7ECA2EF27FC64198D377D7CA3AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 821KB
SHA256 6d0aee3ac58a11309f9a1ce40e73dd7613149a25982ed2ec7aa2db5f0f1eaa0a
MD5 dc76f973e7aab753d072c55a5e314f35
SHA1 3852f13cf6bffefec92b3110a0c5c2bce43d2a80
SHA512 60e09826b4a3f294ae270c6e65c4a52dd6e3c1955f80f4efa7389b3109947dba61f59b1efe853bbdcf333519753d51e9f44f44fc472111d5a7645ab4ebc84fe5
SSDEEP 12288:pmw5HEjsChNBBFgl0WDm+CI+CUQEpBwli67u6tcRPf2KY9DTQLGMz2yNXoJTGEdK:kwu4OWqC302u6609DT4G+dhoJiwy
TLSH
T13205AF9375B96C69D30D953484EF5E26DAE27C391F0962F76789AB237C3AB408C35B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

emdpmifb.tmp

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\emdpmifb.tmp
Size 6.6MB
SHA256 6d5c4773100bf6cf1b9e273ae2b17dd33fae81ded945d36f8c988d10d2b275d3
MD5 51a4b38c91063c72d84fd74116eff8bb
SHA1 59a7555ad73f2edfed4c2c3a7a833a960fffb5b5
SHA512 ffd458ea9afa6c43c159e42f9a930d540b3e5dc5e0c78bf5527c20f9412523f3ae014c8be7c148c3582e4b7dc8016e1cc2c56b830f014cb6168d8e1e704c4a3e
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeZAaLSF259ruMHwpXMi4FqJLd23U1:xQRQyi36YOcPZLvw2gAf+PN3roLQtJV
TLSH
T1AD667C03F3A541E8E05ED9B4CF3952229B357C4A8BF192EF259436E11A72DD47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f99ddf8ace51b962b7d12ea12e25836845f5e7b895ee22f99e4926a602311151
MD5 cb50e8febbd5e8dd9c4c2e651d458d37
SHA1 d83dd5b0e67640569d0160810aeafe71c8129843
SHA512 955ae2d0bdbb79bf6486e922830086814ba40920da2e0d5e9e54baad52c07657ac3a9931640f388a828ef09417e1075181908aa1538a812add2784314d044ea7
SSDEEP 49152:EB+taZ3usBWOBr4tEGq0bqx0z+n217aau1gl3hVT4BjC:eu6JmAxd2d3hVT4c
TLSH
T16ED58C13F1D621E8D059C079979AA233EA62BC494B21F6DF0AA073152E77EE49F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a22cd3ac14606e0dd880d27fd19a49d01b030f238ffb0514c6688333e7193d10
MD5 94a216a4f8dc56cb87910b9420b69dc3
SHA1 bcc64146257268c7b7231f375aa233fc89686af1
SHA512 09da00180ef305c125078cc1d3b32919b170587ae706aaa9377cfcdb3796bc08584c393a72f18afaf8faf9c67f0738a1dc3fa8f5eb3ed27aba9f39ef60c5dc5d
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYol2DziZgsvn8bM4Gx:Egb4mBIBhGFvqzi6tFG
TLSH
T19E659D1F32D801E5F5BAE2B49C7A4427D7B274099B31E3CF126886692F67AF05D39702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e35c33fa32b276b411552c0925c5f3ae616fa927ce6ad23c2e5b2894dffdf1a9
MD5 8df3a77a9b688f9984d7fce5926d7256
SHA1 bc3131d49e9c8e6cab80e5d5ae6ea497c7e70e85
SHA512 d0a4bd5180d88b11b213c3b2eeff6ab2bf91133ed92704720da1424fe9a330cb02f5faa99d77628e1668ee82d1e736b08fc4049763f1bf8f62620473772b4273
SSDEEP 24576:yG88u8FpJqH12zria7/mFW320s66fid3XOt6mobg/SvTp7v8KiPGzl5WDM8j3/OC:p7ZFPqVBa7/6SXOyziPGzPWD5jg
TLSH
T1B035BE139AB934F6CA33B17ED9458281EBA2B812033EDBDB0FB44C071E5666D167DE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-31-0x0000000140000000-0x00000001402CA000-memory.dmp

Download

memory/728-20-0x0000000140000000-0x00000001402CA000-memory.dmp

Download

memory/1272-102-0x0000000140000000-0x00000001404C8000-memory.dmp

Download

memory/1272-15-0x0000000140000000-0x00000001404C8000-memory.dmp

Download

memory/2468-10-0x0000000140000000-0x00000001404DE000-memory.dmp

Download

memory/2468-9-0x0000000140000000-0x00000001404DE000-memory.dmp

Download

memory/3428-36-0x0000000140000000-0x00000001402C4000-memory.dmp

Download

memory/3428-112-0x0000000140000000-0x00000001402C4000-memory.dmp

Download

memory/3836-113-0x0000000140000000-0x0000000140333000-memory.dmp

Download

memory/3836-47-0x0000000140000000-0x0000000140333000-memory.dmp

Download

memory/4680-52-0x0000000140000000-0x000000014035C000-memory.dmp

Download

memory/4680-59-0x0000000140000000-0x000000014035C000-memory.dmp

Download

memory/5768-0-0x0000000000400000-0x000000000085D000-memory.dmp

Download

memory/5768-1-0x0000000000400000-0x000000000085D000-memory.dmp

Download