Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 01:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe
- Size 3.8MB
- Sample260913-b9gdbade69
- SHA256 390ea898d79b22015a73c03caab27d87e01fb6f607fec085dd8592fea8601f81
- MD5 52110b5915f52fa94d25f932aafb2e4c
- SHA1 f31342f16b1a00a6b8e2fd25263c87863758df95
- SHA512 ed9f08298adaa173c211c433948f0f5702505ea1797b7d46e1f1b198260fef7cca4e690ea81875d9dce0c4d028b7be2afcf749d0a52eda55c2a5cc371814186c
- SSDEEP 98304:8uiif5WJ1kAkVMybchI69v+DcEkhMUloJAy5M4l:8Aouc6cv+DcEkhMuOAy57
- TLSH T1E8069E12BB915036F9B302B189FE7269A9BD7EA00738C4CB12C81ADD5E31AE17D35753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmstp.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\curl.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\PING.EXE 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sfc.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\cscript.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\expand.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\finger.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\sudo.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\choice.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\instnm.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1_none_a454f54474148daf\dpnsvr.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\bfsvc.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\securekernel.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\r\ByteCodeGenerator.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmEngine.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\r\RMActivate_ssp_isv.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\AppVDllSurrogate.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\splwow64.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\doskey.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\r\mount.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\WmsUserAgent.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\bthudtask.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_9624bcf361cbb3f2\ntprint.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1_none_45fe1c64c43dedc8\GamePanel.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\r\FileDialogBroker.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15912.0_none_65c6ab619fd35783\WsatConfig.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_ac6c889a5b4138e1\aspnet_regsql.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\SndVol.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.26100.1150_none_fba3bb9888bf82a5\r\CompPkgSrv.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_bc8d33c5efdd20ef\r\edpnotify.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\Robocopy.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\r\SpaceAgent.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\vmconnect.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1591_none_fdef694f47f84aa8\wpr.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\r\nfsclnt.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\Microsoft.AAD.BrokerPlugin.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\poqexec.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UNPUXHost.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\r\dsmgmt.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\mount.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.0_none_7f1c6fee223c55e3\mscorsvw.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1_none_08f675ddb6f77c4f\dvdplay.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_e9f03efdb03c43d2\dsacls.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\TieringEngineService.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_107a08446d17dcf2\aspnet_wp.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.26100.1591_none_b7c9eb31fbd37700\SpeechUXWiz.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61c655cc264adc4b\ilasm.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.26100.1_none_6e96156553a511df\dplaysvr.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVShNotify.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.26100.1591_none_85f1fbdaacd275e0\SystemSettingsBroker.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\prevhost.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_f6e8e32b1e1f23da\compact.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1_none_2236fe932b70aa37\dccw.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\CustomInstallExec.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\RMActivate_isv.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_895815212ed14bd2\timeout.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\unsecapp.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winver_31bf3856ad364e35_10.0.26100.1_none_bd99d0ef3966360f\winver.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_c8bf902cd831831a\CasPol.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\r\AddSuggestedFoldersToLibraryDialog.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\cttunesvr.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmscrub.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.26100.1150_none_01782765ebe4af77\r\UserDataSource.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\r\WpcTok.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1000_none_e9c96c85d0fddddd\r\mstsc.exe 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_52110b5915f52fa94d25f932aafb2e4c_amadey_elex_luca-stealer_manuscrypt_njrat_rhadamanthys_smoke-loader_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4292