c8ec33a2092c1a997b1a0a4324cc4f93ad50e0e4bb16ed51c448a8f9f5ad3c41

Analysis

max time kernel
149s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Size 246KB
Sample261027-pl8dsa1w7q
SHA256 c8ec33a2092c1a997b1a0a4324cc4f93ad50e0e4bb16ed51c448a8f9f5ad3c41
MD5 8a804dc83c9c0e808f82f22cdf2b593c
SHA1 421f35e5ef416d4ecb7518d950ab7b429c61e90b
SHA512 c40b0da79bbe132cf69d7f6acb2302a02dac20541761fa72bffcc14d002f3d7eccb14fa16cb92220eb66e41ac22462bf46d3311a1e03ec1418fe14c1064d3efb
SSDEEP 6144:Gtsct9w6EIEFtRDts72Z9c6Ty8Hwmcd0eQWH:Gtsct+xIEkOO8HHc5QWH
TLSH
T11F347D10BD92C032D56258374839DB7A893EBCA04F2169CBA3841DFEDA347D19B39B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution impact ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4116	cmd.exe
2136	cmd.exe
2876	cmd.exe
2672	cmd.exe
1120	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1752	WMIC.exe
Token: SeSecurityPrivilege	1752	WMIC.exe
Token: SeTakeOwnershipPrivilege	1752	WMIC.exe
Token: SeLoadDriverPrivilege	1752	WMIC.exe
Token: SeSystemProfilePrivilege	1752	WMIC.exe
Token: SeSystemtimePrivilege	1752	WMIC.exe
Token: SeProfSingleProcessPrivilege	1752	WMIC.exe
Token: SeIncBasePriorityPrivilege	1752	WMIC.exe
Token: SeCreatePagefilePrivilege	1752	WMIC.exe
Token: SeBackupPrivilege	1752	WMIC.exe
Token: SeRestorePrivilege	1752	WMIC.exe
Token: SeShutdownPrivilege	1752	WMIC.exe
Token: SeDebugPrivilege	1752	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1752	WMIC.exe
Token: SeRemoteShutdownPrivilege	1752	WMIC.exe
Token: SeUndockPrivilege	1752	WMIC.exe
Token: SeManageVolumePrivilege	1752	WMIC.exe
Token: 33	1752	WMIC.exe
Token: 34	1752	WMIC.exe
Token: 35	1752	WMIC.exe
Token: 36	1752	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1752	WMIC.exe
Token: SeSecurityPrivilege	1752	WMIC.exe
Token: SeTakeOwnershipPrivilege	1752	WMIC.exe
Token: SeLoadDriverPrivilege	1752	WMIC.exe
Token: SeSystemProfilePrivilege	1752	WMIC.exe
Token: SeSystemtimePrivilege	1752	WMIC.exe
Token: SeProfSingleProcessPrivilege	1752	WMIC.exe
Token: SeIncBasePriorityPrivilege	1752	WMIC.exe
Token: SeCreatePagefilePrivilege	1752	WMIC.exe
Token: SeBackupPrivilege	1752	WMIC.exe
Token: SeRestorePrivilege	1752	WMIC.exe
Token: SeShutdownPrivilege	1752	WMIC.exe
Token: SeDebugPrivilege	1752	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1752	WMIC.exe
Token: SeRemoteShutdownPrivilege	1752	WMIC.exe
Token: SeUndockPrivilege	1752	WMIC.exe
Token: SeManageVolumePrivilege	1752	WMIC.exe
Token: 33	1752	WMIC.exe
Token: 34	1752	WMIC.exe
Token: 35	1752	WMIC.exe
Token: 36	1752	WMIC.exe
Token: SeBackupPrivilege	1260	vssvc.exe
Token: SeRestorePrivilege	1260	vssvc.exe
Token: SeAuditPrivilege	1260	vssvc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4172	2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4116	4172	2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	84
PID 4172 wrote to memory of 2136	4172	2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	86
PID 2136 wrote to memory of 1752	2136	cmd.exe	88
PID 4172 wrote to memory of 2876	4172	2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	91
PID 4172 wrote to memory of 2672	4172	2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	93
PID 4172 wrote to memory of 1120	4172	2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe	95

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_8a804dc83c9c0e808f82f22cdf2b593c_amadey_cobalt-strike_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wmic.exe shadowcopy delete /nointeractive
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic.exe shadowcopy delete /nointeractive
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c wbadmin.exe delete catalog -quiet
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1120