cccf6a9e1b3137cfb220bc18588febe032e4a4891511e037684b1c6bf82b9524

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_b758843a63761b70253a9633e45b07eb_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 286KB
Sample261026-sbjt8aex2w
SHA256 cccf6a9e1b3137cfb220bc18588febe032e4a4891511e037684b1c6bf82b9524
MD5 b758843a63761b70253a9633e45b07eb
SHA1 c48209abda1e8c4003bb561f1c15018c94d53db4
SHA512 edafeb6a1d345527680dbe7b0c77be78829e660c8f971aab3372f7ae8cdb650cd8f78bf8164a1a6958ea0570d900704a28f36de015c9ad2bb1c40ae5f0cb11cc
SSDEEP 6144:Ks8ZdT9q7nGJUeCCeHHQTR9Vwif/ZBT8p3UekAUntXoAOmUEGC:GV3UjCeHHQTrVTf/ZBIpKtXoU
TLSH
T16B548C10B683C432D5B215361A38D766497EBE310F259AEBA3D44E7ECE301C1AA35F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery execution persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-10-25_b758843a63761b70253a9633e45b07eb_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	2026-10-25_b758843a63761b70253a9633e45b07eb_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1004	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_b758843a63761b70253a9633e45b07eb_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 1004	5656	2026-10-25_b758843a63761b70253a9633e45b07eb_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-25_b758843a63761b70253a9633e45b07eb_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_b758843a63761b70253a9633e45b07eb_amadey_cobalt-strike_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1004