Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 19:27
General
- Target 2026-11-06_eeae74abe58b47e58e32d1d9ba2e9697_amadey_elex_luca-stealer_njrat_smoke-loader.exe
- Size 2.5MB
- Sample261107-x591qaew8w
- SHA256 1f5131e91c09a623bdb2ddec6f8cd3db9fcac4357ff8ec5fb5e4e22af6a9473c
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-06_eeae74abe58b47e58e32d1d9ba2e9697_amadey_elex_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-06_eeae74abe58b47e58e32d1d9ba2e9697_amadey_elex_luca-stealer_njrat_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "exit 0"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).RealTimeProtectionEnabled) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "if ((Get-MpComputerStatus).IsTamperProtected) { exit 0 } else { exit 1 }"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_owdwjgbt.gfk.psm1
memory/1224-33-0x0000000006FD0000-0x0000000006FDA000-memory.dmp
memory/1224-24-0x0000000070400000-0x000000007044C000-memory.dmp
memory/1224-37-0x0000000074120000-0x00000000748DC000-memory.dmp
memory/1224-36-0x0000000074120000-0x00000000748DC000-memory.dmp
memory/1224-34-0x00000000071D0000-0x0000000007266000-memory.dmp
memory/1224-32-0x0000000006F40000-0x0000000006F5A000-memory.dmp
memory/1224-31-0x00000000075A0000-0x0000000007C1C000-memory.dmp
memory/1224-30-0x0000000074120000-0x00000000748DC000-memory.dmp
memory/1224-29-0x0000000006DF0000-0x0000000006E93000-memory.dmp
memory/1224-15-0x0000000074120000-0x00000000748DC000-memory.dmp
memory/1224-16-0x0000000074120000-0x00000000748DC000-memory.dmp
memory/1224-25-0x0000000074120000-0x00000000748DC000-memory.dmp
memory/1224-19-0x0000000005880000-0x0000000005BDB000-memory.dmp
memory/1224-20-0x0000000074120000-0x00000000748DC000-memory.dmp
memory/1224-23-0x00000000060C0000-0x00000000060F6000-memory.dmp
memory/1224-22-0x00000000061A0000-0x00000000061EC000-memory.dmp
memory/1224-28-0x00000000060A0000-0x00000000060C0000-memory.dmp
memory/4180-8-0x0000000005220000-0x0000000005286000-memory.dmp
memory/4180-0-0x00000000742F2000-0x00000000742F3000-memory.dmp
memory/4180-3-0x00000000052B0000-0x00000000058FA000-memory.dmp
memory/4180-14-0x00000000742E0000-0x0000000074A9C000-memory.dmp
memory/4180-12-0x0000000005EC0000-0x0000000005F0C000-memory.dmp
memory/4180-11-0x0000000005E70000-0x0000000005E8E000-memory.dmp
memory/4180-2-0x00000000742E0000-0x0000000074A9C000-memory.dmp
memory/4180-10-0x00000000059E0000-0x0000000005D3B000-memory.dmp
memory/4180-9-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/4180-4-0x00000000742E0000-0x0000000074A9C000-memory.dmp
memory/4180-5-0x0000000005080000-0x00000000050A2000-memory.dmp
memory/4180-1-0x0000000002610000-0x0000000002646000-memory.dmp
memory/4544-38-0x0000000005FB0000-0x000000000630B000-memory.dmp
memory/4544-42-0x0000000006AB0000-0x0000000006AFC000-memory.dmp
memory/4544-43-0x0000000074A40000-0x0000000074A8C000-memory.dmp
memory/4544-46-0x0000000007810000-0x00000000078B3000-memory.dmp