e3eb0b51fe8e74819e568a798d032dc042dd3073c5ff372e22a69b68bd323ac2

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Size 1.4MB
Sample261107-mp2z3acv2n
SHA256 e3eb0b51fe8e74819e568a798d032dc042dd3073c5ff372e22a69b68bd323ac2
MD5 ba717341fa82b32c4ab80785ebb2bb9e
SHA1 59af17cb39805ccf6de6ec67963c713546cc0e5a
SHA512 80a96474af79d7d93ef8499bd50769bd09df625d2f26a6a83380892f923a427cdc2e6531de7bbe827ed46052719f5acdbab690746ccfe9563d93b3a5611f087b
SSDEEP 24576:6c8KjKjGFygcc23L1/NVOmOSGb6E3ecS4fzrjxJh9UZXlpbPvC7xtYUrEmFlo+LC:CKjKWQc2b1FVgbjrjxPe1pbPSQm1FloT
TLSH
T1A3652301B2E48035E8F31E3064B4D9B55B7EFD6069309A5B239A0E2D6F34AC1EA35777
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/4420-2-0x0000000000850000-0x000000000086E000-memory.dmp	UPX
behavioral2/memory/4420-1-0x0000000000850000-0x000000000086E000-memory.dmp	UPX
behavioral2/memory/4420-3-0x0000000000850000-0x000000000086E000-memory.dmp	UPX
behavioral2/memory/4420-76-0x0000000000850000-0x000000000086E000-memory.dmp	UPX
behavioral2/memory/4420-83-0x0000000000850000-0x000000000086E000-memory.dmp	UPX

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\autorun.inf	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	F:\autorun.inf	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	F:\autorun.inf	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4420-2-0x0000000000850000-0x000000000086E000-memory.dmp	upx
behavioral2/memory/4420-1-0x0000000000850000-0x000000000086E000-memory.dmp	upx
behavioral2/memory/4420-3-0x0000000000850000-0x000000000086E000-memory.dmp	upx
behavioral2/memory/4420-76-0x0000000000850000-0x000000000086E000-memory.dmp	upx
behavioral2/memory/4420-83-0x0000000000850000-0x000000000086E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_id.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Temp\GUT51A2.tmp	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_bg.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_el.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_zh-CN.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_iw.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_kn.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ru.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ta.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_th.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_tr.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_zh-TW.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\psmachine.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\psmachine_64.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_bn.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_en-GB.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_it.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_uk.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_da.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_sk.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_es.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_fil.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_pt-BR.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\psuser.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_hi.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_no.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_te.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_cs.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_sr.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\GoogleUpdateCore.exe	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_de.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_lt.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_mr.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ur.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_hu.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_is.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_lv.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ml.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_et.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\GoogleUpdateOnDemand.exe	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\GoogleUpdateComRegisterShell64.exe	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_fa.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ca.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_en.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_gu.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_sl.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\GoogleUpdate.exe	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\GoogleCrashHandler.exe	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\GoogleUpdateBroker.exe	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ja.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ko.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_nl.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ro.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_vi.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_pl.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_sv.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdate.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ar.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_hr.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\psuser_64.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_es-419.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_fr.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
File created	C:\Program Files (x86)\Google\Temp\GUM51A1.tmp\goopdateres_ms.dll	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_ba717341fa82b32c4ab80785ebb2bb9e_amadey_elex_hijackloader_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops autorun.inf file
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4420-0-0x0000000000400000-0x0000000000565000-memory.dmp

Download

memory/4420-2-0x0000000000850000-0x000000000086E000-memory.dmp

Download

memory/4420-1-0x0000000000850000-0x000000000086E000-memory.dmp

Download

memory/4420-3-0x0000000000850000-0x000000000086E000-memory.dmp

Download

memory/4420-76-0x0000000000850000-0x000000000086E000-memory.dmp

Download

memory/4420-83-0x0000000000850000-0x000000000086E000-memory.dmp

Download

memory/4420-87-0x0000000000400000-0x0000000000565000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads