Overview

overview

10

Static

static

3

2026-10-01...er.exe

windows10-2004-x64

10

2026-10-01...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    131s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 23:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
  • Size 289KB
  • Sample261001-23lmkace79
  • SHA256 aa6ce90437fbc9c88f3e1798e38cd0839e11296b81f500fafc2a70e0d8416a16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionxmrigminerpersistencethemidatrojanupx

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    ftp.vietnam852.com
  • Port

    21
  • Username

    123
  • Password

    123

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Contacts a large (22851) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Detects executables embedding registry key / value combination manipulating RDP / Terminal Services 24 IoCs
  • Detects executables packed with Themida 58 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • UPX dump on OEP (original entry point) 21 IoCs
  • XMRig Miner payload 23 IoCs
    miner
  • Downloads MZ/PE file 10 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes a file named after a Windows system binary 1 TTPs 8 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 25 IoCs
  • Themida packer 30 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 10 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 1 TTPs 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 10 IoCs
    defense_evasion
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 20 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 23 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Executes a file named after a Windows system binary
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Users\Admin\AppData\Local\Temp\dllhost.exe
      "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3036
    • C:\Users\Admin\AppData\Local\Temp\down.exe
      "C:\Users\Admin\AppData\Local\Temp\down.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\down.exe
        "C:\Users\Admin\AppData\Local\Temp\down.exe" --skip-elevate
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5356
        • C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe
          "C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe" --skip-elevate
          4⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Drops file in Windows directory
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of WriteProcessMemory
          PID:1872
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe\"" /sc daily /st 02:30 /f /ru SYSTEM /rl HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3084
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 sihost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5636
          • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe
            "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:3400
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 svchost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2220
          • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe
            "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4784
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /F /TN "MicrosoftEdgeUpdateTaskMachineCore" /TR "\"C:\Windows\Fonts\NET.Framework\dllhost.exe\"" /SC MINUTE /MO 30 /RU SYSTEM /RL HIGHEST
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:4324
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 dllhost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4368
          • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe
            "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2612
    • C:\Users\Admin\AppData\Local\Temp\sihost.exe
      "C:\Users\Admin\AppData\Local\Temp\sihost.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:5816
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes a file named after a Windows system binary
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "MicrosoftEdgeUpdateTaskMachineCore" /TR "\"C:\Windows\Fonts\NET.Framework\dllhost.exe\"" /SC MINUTE /MO 30 /RU SYSTEM /RL HIGHEST
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2856
    • C:\Users\Admin\AppData\Local\Temp\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\wininit.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6100
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn MicrosoftEdgeUpdateTaskMachineUA{CEC15D9B-F4BB-446A-B6E1-C61E74B016A2} /tr \"C:\Users\Admin\AppData\Local\Temp\wininit.exe\" /sc minute /mo 30 /f /ru SYSTEM /rl HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2696
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C schtasks.exe /Create /TN "MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}" /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe\"" /SC DAILY /ST 01:00 /F /RU "SYSTEM"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:468
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /Create /TN "MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}" /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe\"" /SC DAILY /ST 01:00 /F /RU "SYSTEM"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2580
  • C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe
    "C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe
      "C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe" --skip-elevate
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:5428
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe\"" /sc daily /st 02:30 /f /ru SYSTEM /rl HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:716
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 sihost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:120
      • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe
        "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:2456
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 svchost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1832
      • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe
        "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5336
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /F /TN "MicrosoftEdgeUpdateTaskMachineCore" /TR "\"C:\Windows\Fonts\NET.Framework\dllhost.exe\"" /SC MINUTE /MO 30 /RU SYSTEM /RL HIGHEST
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:5824
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 dllhost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5892
      • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe
        "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6040
  • C:\Users\Admin\AppData\Local\Temp\sihost.exe
    C:\Users\Admin\AppData\Local\Temp\sihost.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3388
  • C:\Windows\Fonts\NET.Framework\dllhost.exe
    "C:\Windows\Fonts\NET.Framework\dllhost.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /F /TN "MicrosoftEdgeUpdateTaskMachineCore" /TR "\"C:\Windows\Fonts\NET.Framework\dllhost.exe\"" /SC MINUTE /MO 30 /RU SYSTEM /RL HIGHEST
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3864
  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Executes a file named after a Windows system binary
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:124
    • C:\Users\Admin\AppData\Local\Temp\dllhost.exe
      "C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4304
    • C:\Users\Admin\AppData\Local\Temp\down.exe
      "C:\Users\Admin\AppData\Local\Temp\down.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Users\Admin\AppData\Local\Temp\down.exe
        "C:\Users\Admin\AppData\Local\Temp\down.exe" --skip-elevate
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5628
        • C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe
          "C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe" --skip-elevate
          4⤵
          • Downloads MZ/PE file
          • Executes dropped EXE
          • Drops file in Windows directory
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious use of WriteProcessMemory
          PID:5688
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\dfsvc.exe\"" /sc daily /st 02:30 /f /ru SYSTEM /rl HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4220
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 sihost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4880
          • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe
            "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:2804
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 svchost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4840
          • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe
            "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3800
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /F /TN "MicrosoftEdgeUpdateTaskMachineCore" /TR "\"C:\Windows\Fonts\NET.Framework\dllhost.exe\"" /SC MINUTE /MO 30 /RU SYSTEM /RL HIGHEST
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1192
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\.NET Framework\.NET Framework NGEN v3.5.30729.5420 dllhost.exe" /tr "\"C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe\"" /sc daily /st 03:30 /f /ru SYSTEM /rl HIGHEST
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3436
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              6⤵
                PID:2612
            • C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe
              "C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\dllhost.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3088
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C schtasks.exe /Create /TN "MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}" /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe\"" /SC DAILY /ST 01:00 /F /RU "SYSTEM"
        2⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5380
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Create /TN "MicrosoftEdgeUpdateTaskMachineCore{4C33CE3F-7722-4257-AF83-351A4911C159}" /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-10-01_e598728a3c119ef1a8060097ac1d583b_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe\"" /SC DAILY /ST 01:00 /F /RU "SYSTEM"
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4524
    • C:\Users\Admin\AppData\Local\Temp\wininit.exe
      "C:\Users\Admin\AppData\Local\Temp\wininit.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2580

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Debugger Evasion

          1
          T1622

          Masquerading

          1
          T1036

          Match Legitimate Name or Location

          1
          T1036.005

          Virtualization/Sandbox Evasion

          1
          T1497

          Credential Access

          Discovery

          Debugger Evasion

          1
          T1622

          Network Service Discovery

          2
          T1046

          Query Registry

          4
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          2
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Virtualization/Sandbox Evasion

          1
          T1497

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          WinRing0x64.sys
          • Path C:\Users\Admin\AppData\Local\Temp\WinRing0x64.sys
          • Size 14KB
          • SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _dl.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_dl.txt
          • Size 502B
          • SHA256 d6a3e0f445d0a17314ab89cfb3c78deabc66a6ff30f991c2c44a6fbd04da85ab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _dl.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_dl.txt
          • Size 339B
          • SHA256 538a70fd4759ce218309b8ddb07362a276321c6af42bf59e8c617913e3f70a6f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ed.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_ed.txt
          • Size 1KB
          • SHA256 96e0f934070533e7acf12adfde29b5b5cb42404c9c40933c35ff35344b6e33bd
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ed.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_ed.txt
          • Size 232B
          • SHA256 90558e5d3ac67701ee4c8afdd382d20fe11513f8e72fae83d6beb98a8fd0ee8d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ed.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_ed.txt
          • Size 1KB
          • SHA256 b7ca8109ed35d3820d18d3eebf9c971aa3fe71aaaa1c52725e1a96d9d57e18df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ed.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_ed.txt
          • Size 1KB
          • SHA256 30edc0bb94fdbcdeeaadd0883f595643a8e1590c91c55eb09dff36857ebaa8cb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ed.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_ed.txt
          • Size 560B
          • SHA256 c6e62300a0e8e4d70ee1c7e6391ceafd96ff36f927788688be6be6bfa05309be
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ed.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_ed.txt
          • Size 803B
          • SHA256 6255eff18a387c7f3eb92a272641e2d1feb76336e931097983322f6decb48291
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ed.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_ed.txt
          • Size 775B
          • SHA256 a3bb990c55d3e731213c8560502b0ca8414fe6730b8d4bf397dcf56e47d39335
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ed.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_ed.txt
          • Size 927B
          • SHA256 3cc60d9a485bd59d8e4164990d047d088e456d83f03717326d59a84dcec8bffa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dllhost.exe
          • Path C:\Users\Admin\AppData\Local\Temp\dllhost.exe
          • Size 111KB
          • SHA256 d8a6ecdbc98dc115b61a83aaee5bb8349be5d6313cdc7f8cea0e141658306b49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          down.exe
          • Path C:\Users\Admin\AppData\Local\Temp\down.exe
          • Size 179KB
          • SHA256 4a07f64f15fb4361b87fe262c6a2020f11ca80d2d5cb2c5ff626cb5baefeab61
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wininit.exe
          • Path C:\Users\Admin\AppData\Local\Temp\wininit.exe
          • Size 10.2MB
          • SHA256 96224da03171b08f4b6283a657d76f220ccf8f7465c55006c650f28f897b798d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dllhost.ini
          • Path C:\Windows\Fonts\NET.Framework\dllhost.ini
          • Size 39B
          • SHA256 b60392fa012482adf3cd1eb1e3676a623243f4520982735c81c0e57478af402e
          • MD5 SHA1 SHA512
          Submit Download

          sihost.exe
          • Path C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\sihost.exe
          • Size 5.8MB
          • SHA256 d49d95185136452c3347f2f4af78680f1c34520aa588c6954f0f61e4612174cf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.exe
          • Path C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft.NET\svchost.exe
          • Size 4.1MB
          • SHA256 9b4f90fab322fca73705acd7dda13918b9d67d719033f124a51d6de00da925ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hosts
          • Path C:\Windows\System32\drivers\etc\hosts
          • Size 1KB
          • SHA256 8c9fd8477b42d2a2f61583fe81783d040d1d0132f6dea1885b30f4d3bee22f05
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\TEMP\_dl.txt
          • Size 1KB
          • SHA256 6c2fbf2ea10062ad9d5cb7e975a30e052f27cf5b5c5675877a0f4480169dc6c1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\TEMP\_dl.txt
          • Size 2KB
          • SHA256 c45de4f9b131d8fea8912624c51d84a6247cd9a3357ef9d02a13fb1fe07ddc82
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\TEMP\_dl.txt
          • Size 3KB
          • SHA256 423734f4d1167e44757e1d7358a1ea9495ded9e9a7792a0c097a3c29d6e6117f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\TEMP\_dl.txt
          • Size 5KB
          • SHA256 e9088c128195c7fe911d2c3ce8f13c248eec2d7582d3ebde2ad139307d58e28b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\TEMP\_dl.txt
          • Size 6KB
          • SHA256 2a9ecfbf372dbb54c4a783d2ed622dde2a89be937e0f388e33a2746200114541
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\TEMP\_dl.txt
          • Size 911B
          • SHA256 3173cf7332362b0bf7cb1cf0b27210a2d7942f102bae2485703511b418b4b691
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\Temp\_dl.txt
          • Size 3KB
          • SHA256 7b3998cfe1cef52ab7aca1bc1678ae3140deda8c81d4d83ba7872d790afb4ca7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\Temp\_dl.txt
          • Size 4KB
          • SHA256 fdd25d6a8a389d6cd3cd84b778cbeb5ed4811d9daac86365d5fa81b2d157d385
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\Temp\_dl.txt
          • Size 380B
          • SHA256 513e9a998d4be026e35296cf098c204e2d43979960d5615dddced562cc07c0bb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _dl.txt
          • Path C:\Windows\Temp\_dl.txt
          • Size 1KB
          • SHA256 6c7883c3e0b4aa21e2a6b774f7535a2fae21b29381f8cac2b166b067b996905b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/124-230-0x0000000000AE0000-0x0000000000B2C000-memory.dmp
          Download

          memory/1216-57-0x00007FF63AFF0000-0x00007FF63B06F000-memory.dmp
          Download

          memory/1216-25-0x00007FF63AFF0000-0x00007FF63B06F000-memory.dmp
          Download

          memory/1872-177-0x00007FF63F0D0000-0x00007FF63F14F000-memory.dmp
          Download

          memory/1872-60-0x00007FF63F0D0000-0x00007FF63F14F000-memory.dmp
          Download

          memory/1932-229-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/1932-227-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/1932-268-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/1932-400-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/1932-226-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/1932-228-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/2456-247-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/2456-300-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/2456-246-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/2456-249-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/2456-248-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/2456-245-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/2612-292-0x00007FF7EDDC0000-0x00007FF7EDE0B000-memory.dmp
          Download

          memory/2612-207-0x00007FF7EDDC0000-0x00007FF7EDE0B000-memory.dmp
          Download

          memory/2612-174-0x00007FF7EDDC0000-0x00007FF7EDE0B000-memory.dmp
          Download

          memory/2864-106-0x00007FF63F0D0000-0x00007FF63F14F000-memory.dmp
          Download

          memory/3036-12-0x00007FF6BFD50000-0x00007FF6BFD9B000-memory.dmp
          Download

          memory/3036-15-0x00007FF6BFD50000-0x00007FF6BFD9B000-memory.dmp
          Download

          memory/3388-160-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3388-158-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3388-162-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3388-188-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3388-161-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3388-159-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3400-135-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3400-137-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3400-138-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3400-139-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3400-136-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/3400-143-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/4288-0-0x0000000000AE0000-0x0000000000B2C000-memory.dmp
          Download

          memory/4304-353-0x00007FF6DF1A0000-0x00007FF6DF1EB000-memory.dmp
          Download

          memory/4784-216-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-266-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-153-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-354-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-152-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-151-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-332-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-206-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-150-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/4784-149-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5076-184-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5076-183-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5076-328-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5076-186-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5076-185-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5076-208-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5076-385-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5076-267-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5336-287-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5336-288-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5336-290-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5336-289-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5336-348-0x0000000000400000-0x0000000000EA4000-memory.dmp
          Download

          memory/5356-67-0x00007FF63AFF0000-0x00007FF63B06F000-memory.dmp
          Download

          memory/5428-270-0x00007FF63F0D0000-0x00007FF63F14F000-memory.dmp
          Download

          memory/5428-204-0x00007FF63F0D0000-0x00007FF63F14F000-memory.dmp
          Download

          memory/5428-377-0x00007FF63F0D0000-0x00007FF63F14F000-memory.dmp
          Download

          memory/5428-257-0x00007FF63F0D0000-0x00007FF63F14F000-memory.dmp
          Download

          memory/5428-327-0x00007FF63F0D0000-0x00007FF63F14F000-memory.dmp
          Download

          memory/5816-205-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/5816-258-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/5816-331-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/5816-210-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/5816-140-0x0000000000E10000-0x0000000000E30000-memory.dmp
          Download

          memory/5816-128-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/5816-130-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/5816-131-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/5816-129-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/5816-127-0x0000000140000000-0x0000000141178000-memory.dmp
          Download

          memory/6100-269-0x00007FF649B00000-0x00007FF64E216000-memory.dmp
          Download