4ed37628eb32e6aa0cd013b6f4eb8665649c4074ee35412415146f2137951aa8

Analysis

max time kernel
146s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.3MB
Sample260708-e4cpqabw2q
SHA256 4ed37628eb32e6aa0cd013b6f4eb8665649c4074ee35412415146f2137951aa8
MD5 7d9121cf75cea8b0949895a816fb2858
SHA1 ef4403bd493228fa763d060fe7c36d79105f7706
SHA512 21c3ba7c563b2fce44efd8fd3675bba1566c5c5449fff5a6a157895259486c96f862fc52eb766f47656b702caa8d5f1d49e0bb35a071e46b39cf628041206953
SSDEEP 24576:dwfLrvi4cRIyDe3SUNaXy+WypoGH0q4mIJzo/8oAKoFJkS77PhMC:O+i3DsX1WHdxLzo/8oAKoLkSX
TLSH
T1FC65121030D4CC37E4EB257788358AB46EB57E922F066C17BFC476AEE6B3162D6B0215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3660	alg.exe
1508	GameInputSvc.exe
6000	GameInputSvc.exe
2700	elevation_service.exe
5688	elevation_service.exe
6064	maintenanceservice.exe
1844	msdtc.exe
2452	OSE.EXE
4548	PerceptionSimulationService.exe
3104	perfhost.exe
5416	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\tmp287E.tmp	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\SysWOW64\tmp287D.tmp	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\system32\OpenAL32.new	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\tmp3CD2.tmp	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6d58ad3b53e17fad.bin	alg.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWOW64\tmp3CD3.tmp	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File created	C:\Windows\system32\wrap_oal.new	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File created	C:\Program Files (x86)\OpenAL\2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\OpenAL\2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_114359\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6000	GameInputSvc.exe
6000	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5560	2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeTcbPrivilege	1508	GameInputSvc.exe
Token: SeDebugPrivilege	3660	alg.exe
Token: SeDebugPrivilege	3660	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 6000	1508	GameInputSvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_7d9121cf75cea8b0949895a816fb2858_amadey_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:6000

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6064

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1844

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 68cae7b361d3ab234a37d6c5a9a16b3a3a21387b70badea1ebf61c79a565c4e6
MD5 58305d5a0072d25ad79cd4f02ac1c4af
SHA1 21f1867a2dc81ca9726eec9bd9352efec00f5fa3
SHA512 ac41b4d889225e7ca7b5469c6cc87609017c41a009531712c0f2251ad51d5a9f8f1c83f9f2bd79176c664bab4d71e5bf76b857ca660b87614816cccece3ccea3
SSDEEP 49152:l4n632BuPkFKRrdE6oh7stBhuXjfS4LWxnLxLzo/8oAKoLkSX:r3q6gjB0RoUoA7
TLSH
T1ACD59D03F2D900E9E06AD178D7469533EAA2BC890B34B6DF0780B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 7309281172ee942830292e7bbe2b7da272b1033ba3c9b438091682078fc66602
MD5 10d340366ef62c8458fa3bccdf49b788
SHA1 d51259c7dd5cdb95658cdaff9308f2b14a18f188
SHA512 ee86490f2ae1bdc96047c1e54ee18a3ca88f4e6c32ff6aee9a27d932150ce34049a07e2f55eb220f5eafbebf7c4dd39eaef5a2b5a6044422ec8fe3195751933b
SSDEEP 24576:JXY8DcczA8q4mIJzo/8oAKoFJkS77PhMC:FccBxLzo/8oAKoLkSX
TLSH
T12C05022477E408FDED27823DCDA2C416EB32B8514360EB4B47D4896A5F237949E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 2fc8657f40c691b63a8314a0e4ff9223a9aa86673462b7cf9f014a84e81dc99c
MD5 b5b7ebf43ac16ae63b852b0af5bcd62f
SHA1 cbe7ca52b782cfe83ca2fab4d73d03c1e5731e5b
SHA512 7b95cb4428e397134bea92ddbfacabf68238bd182f5a4a3880101e88df53076ef3e91124c147704607b58015c36332f276811ef14f8436bde463f36c7737c252
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+COnTWwR/eHrkPx4U9y/TH3R+F09AKKDFjXNEueS7sEB:Owu+OWRq4mIJzo/8oAKoFJkS77PhMC
TLSH
T1EA05F14136A80CFDE9674639C657C436FBB2B8122A21DB1F5B60C65B9F33311AD2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f786ed86f489ab6afec786ca2e7cd7a76db69d5ec107a88bddc30a709303da6
MD5 3a413fae932abec148177a72a206531e
SHA1 812437fe412c82062e619b243cc880d78ed1c125
SHA512 2da0e65168c283a09ccec53c691bcb40d753974f3359af7cb242b184f78adf73d535e3d3d0ec287725cd8d73769dccc74bbfd4c2e786cd5c48e66c13154143e6
SSDEEP 49152:dQ+taZ3usBWOBr4tEGp0bqx0z+n217aau1glYxLzo/8oAKoLkSX:Ku6JmTxd2dYRoUoA7
TLSH
T154D59D13F1D901E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.dll

Path C:\Windows\SysWOW64\OpenAL32.dll
Size 106KB
SHA256 1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
MD5 235355a8dd26903e75d5e812ecf50e53
SHA1 8316319341a0f9054e19e4a7b21df3dc49386fee
SHA512 5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac
SSDEEP 1536:xYf99QAGcIq+pNocP6YI60qlW+kNvsy/mSvIfttnuQm6A41NbApkh:Hq+pKcPdUqWsyRIfttnu/y1Zk+
TLSH
T1B4B36C51FF824032E0C58E3D81A5CB969BBF19137F9254CBDF7419C85AA03D80A7A7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 e621fa6c7e428c82b3505f7ca11e8dd95abd7cf21064baeb62a11d378a8def93
MD5 8d90d57afe6c7cec06872463594eb683
SHA1 382eae7ac60d60b09ea0314edab303649471f49d
SHA512 ba36b23c9b986fbe753865efdd5e649b8135484ab5f788af6b76e8afc238726311bfd9b99e7dd0c9d824d25eaa4db02a3b1663df84c3f69ded2ae933e6bac2d4
SSDEEP 12288:BD74nTWwR/eHrkPx4U9y/TH3R+F09AKKDFjXNEueS7sEVPhvEC:tYq4mIJzo/8oAKoFJkS77PhMC
TLSH
T1B9D423113FBC591EF9351A3A8E1ED8BBAE24B6750B50CC17FD06458ADCA1E80CEB4917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.new

Path C:\Windows\SysWOW64\wrap_oal.new
Size 434KB
SHA256 a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
MD5 d494267bc169604fac5e3679b9a97fed
SHA1 c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
SHA512 7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040
SSDEEP 6144:0AswvHbkHO2Qc7h3Ckr6A6u35n4boFnugPoHy5AObO5rvbykp:0A9qNyin35n4WugPoEc9ykp
TLSH
T116949E01E591C0F3C4AA48785873975A6B790F6113B9E9F3FFF03C9A9E602E4553624E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 abf6d3867c70e97c378150da89e64c83e233aa43df5a383cc06c010e2c854a2d
MD5 96ae99981c66b63242fcebcf3d7e9a69
SHA1 f1f51b1c897f07fe866208ea9ec766881af91e7b
SHA512 8a563dc40043b48eb3c171d734868fefb499cda43dbeeba54065ed4b8aa34bed9e53f015adf54c511392c6d19b06562f83d493801fb7ce3df5f5d559c40a2dc4
SSDEEP 12288:xGGxCnTWwR/eHrkPx4U9y/TH3R+F09AKKDFjXNEueS7sEVPhvEC:oG4q4mIJzo/8oAKoFJkS77PhMC
TLSH
T1ACE4222039F8346CD936463A8929A8ABBD70757107209DFFDDC194BACF91EE0D678C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.new

Path C:\Windows\System32\OpenAL32.new
Size 120KB
SHA256 87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039
MD5 2ad7b4f3c8d2bb686d231edff404b7a4
SHA1 f29676b96d04bd2765925a3834d9babfdce6a0b3
SHA512 51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528
SSDEEP 3072:mQG3kfDcDKLIjVUl4ZjxNP7ZOqCA48gstZLsFusbdLakZ:ejsxlUVZ7ZOPstm1YkZ
TLSH
T1C9C36BE2715510F9D4EFA378C9A20682D37278249B21A3CF676081562F63BD8BFBD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 6911e7e7c2a4618d4a7459fd60c97b2ff37e26fee2109bd4847752e60b0a409b
MD5 f07b04ad6b31d74a8c2d9d1e9862da78
SHA1 61cb5657ea3e32bfe252ff85f9974e1fba3fe97d
SHA512 ec17f4c9485f0b2345e16bbfd78d2e54bd065435031fad533f557d155d9af0eaaf192f5b79f656bad020fbb4091ae9ab4c1ad014649e1203b6f85f0f1512cb8e
SSDEEP 24576:PPUr+NQfmq4mIJzo/8oAKoFJkS77PhMC:PJQfmxLzo/8oAKoLkSX
TLSH
T14705F12B36EC18E9E676A13D8946861EF771B4620312D6CF06D0817E4F63ED8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 753f9e30461202d7aea6860f0bcbf61cfd9db69205abc0741b3e34e969ef7de1
MD5 302bd4ad38e5aeeaf1d2150bf1aad235
SHA1 68974d86d9aac2f5fa08f2cb91bf0f51bffd53f2
SHA512 68897af894f7ef80036bd3eb8626e370fe399159960a2910f6d1db746bdb36a9730de61548e007cd0ed2dc3040af20c1c7cd6f0e4547e41c2d389ee9c9141443
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYxLzo/8oAKoLkSX:gG05lO43bZRoUoA7
TLSH
T1E1D5C06A62EC11F9D1BBD17CDAC64A0BEBB23415033556CF02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 1b1c95e163445642cada9a8f06f9eca5e5f0fa9727973a96fa64b008f5373af1
MD5 8bb7ffb3b053f4a67eb63a71cefc2115
SHA1 71e51afe6eb6d4f71a281ad5b0af7a7a43d9c1f2
SHA512 60f7c66e57a436c0bd79bb98c99eede4b2d43a61933e67209ab384d895e9a5e4728fbd3240101c3d45e02b5fed616b1c6bcd4c1e18f059c89443ad1b40e7b6f5
SSDEEP 12288:Z/HNk6j5ZI7KNnTWwR/eHrkPx4U9y/TH3R+F09AKKDFjXNEueS7sEVPhvEC:w6DI+tq4mIJzo/8oAKoFJkS77PhMC
TLSH
T1EEF4011C337A10B9D177903EC6834456E6B1B17187625DDF9A84C5BE8EA3EC8B93CE42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 c95069228d3fe5c7f374fa4193fc0e3d4b404da1bd0a8fccd5050d1cddaabb5b
MD5 596b3b2aa8b4c57408ab6dfc279866f4
SHA1 714dcd66417fd9ce0cb772bc857324ebf2383021
SHA512 d47b5b38f1e01590272e3303fbe8d4d95d57b855db4264d401093a975ecce9d6c58dd0479cd679e4536a0c140590c213b23b3bbc39faae2d358e39b0f3c3c171
SSDEEP 12288:TG6kyunTWwR/eHrkPx4U9y/TH3R+F09AKKDFjXNEueS7sEVPhvEC:CtyOq4mIJzo/8oAKoFJkS77PhMC
TLSH
T137F4120037A86059E93516398E2785E69E30BC305B21DADFED81D62EAF72BD0D974F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.new

Path C:\Windows\System32\wrap_oal.new
Size 455KB
SHA256 5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909
MD5 549347bcd4aacd63243d78e8f869dbb1
SHA1 efc00d2a7c5acfe17b8a58023826e6840aef39a6
SHA512 c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5
SSDEEP 6144:ING0FBd3thlYIhSJyYvb3ahwNDx/+IJcaxjCz0G5suFrtxZO+jTyWQqlMfhGy6We:ILVkoWTNV/Qz0vWtxRHQqlM/kb
TLSH
T153A47C91E19184FAD1ABE1349A52AA17F7397C440B3847CB43B0A8711BE3BE469FF354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 71fb4b69db6b3c876c41ff4798b6bfed4728c2a4b1597de131c7901e5acf0484
MD5 4392284ec7fc3c747506387a474f31ef
SHA1 37f6f67c850b30356c6db451ac95901f753cc973
SHA512 1fe8ad71982d7cfad135727c96ca9709ddc23505df43d0beb0ecaf6a028811ae31c763707a3aeccae16fbbb6db0c4d49ea8d9c05f72ae534c89155af8e47ac1a
SSDEEP 24576:UTkNvNnaFeYhJNtmZBmxq4mIJzo/8oAKoFJkS77PhMC:UTMwBtOmxxLzo/8oAKoLkSX
TLSH
T16855AF2E7AF806E4D1FAC6B5CD238512EA727461073293CB9290C13F4E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 f296da8f74b4e052aae8189959fad389e2250f386460b7b245c7198ebe41c2a0
MD5 0aa3834c0d98a8c87c02a2a9728e3a28
SHA1 7af72e1e2d4df8330bdcd81dc58012fff57c3892
SHA512 332ee796362382e5030690274a98c017a10bc9604eb9f69cd19b434d8358cef66eeec9edb86417ccd6d66bf6e3f626ea3e704e6dd8ed465fdc75f14351fd4d04
SSDEEP 12288:BZH6b3IkxjbBz3nTWwR/eHrkPx4U9y/TH3R+F09AKKDFjXNEueS7sEVPhvEC:T6Uqjp3q4mIJzo/8oAKoFJkS77PhMC
TLSH
T1E4F412593AE464ADE4351634D926816B8570BC7203719DEFBAC8957ECF32EC0C53EE22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1508-27-0x0000024787140000-0x00000247871A6000-memory.dmp

Download

memory/1508-26-0x00007FF6A73F0000-0x00007FF6A74B8000-memory.dmp

Download

memory/1508-77-0x00007FF6A73F0000-0x00007FF6A74B8000-memory.dmp

Download

memory/1508-29-0x0000024787140000-0x00000247871A6000-memory.dmp

Download

memory/1508-28-0x0000024787140000-0x00000247871A6000-memory.dmp

Download

memory/1844-90-0x00007FF76F450000-0x00007FF76F569000-memory.dmp

Download

memory/1844-91-0x0000016D13E30000-0x0000016D13E96000-memory.dmp

Download

memory/1844-92-0x0000016D13E30000-0x0000016D13E96000-memory.dmp

Download

memory/1844-168-0x00007FF76F450000-0x00007FF76F569000-memory.dmp

Download

memory/2452-102-0x000001F00B040000-0x000001F00B11E000-memory.dmp

Download

memory/2452-103-0x000001F00B270000-0x000001F00B2D6000-memory.dmp

Download

memory/2452-105-0x000001F00B270000-0x000001F00B2D6000-memory.dmp

Download

memory/2700-45-0x0000020F34340000-0x0000020F343A6000-memory.dmp

Download

memory/2700-46-0x0000020F34340000-0x0000020F343A6000-memory.dmp

Download

memory/2700-44-0x0000020F34190000-0x0000020F3426E000-memory.dmp

Download

memory/3104-171-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3104-121-0x00000000007B0000-0x0000000000819000-memory.dmp

Download

memory/3104-120-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3104-126-0x00000000007B0000-0x0000000000819000-memory.dmp

Download

memory/3660-15-0x00007FF79D520000-0x00007FF79D642000-memory.dmp

Download

memory/3660-16-0x0000029C8BE70000-0x0000029C8BED6000-memory.dmp

Download

memory/3660-18-0x0000029C8BE70000-0x0000029C8BED6000-memory.dmp

Download

memory/3660-50-0x00007FF79D520000-0x00007FF79D642000-memory.dmp

Download

memory/3660-17-0x0000029C8BE70000-0x0000029C8BED6000-memory.dmp

Download

memory/4548-111-0x00007FF7AFF80000-0x00007FF7B00C9000-memory.dmp

Download

memory/4548-114-0x0000021543A60000-0x0000021543AC6000-memory.dmp

Download

memory/4548-113-0x0000021543A60000-0x0000021543AC6000-memory.dmp

Download

memory/4548-169-0x00007FF7AFF80000-0x00007FF7B00C9000-memory.dmp

Download

memory/5416-336-0x00007FF7B2A40000-0x00007FF7B3183000-memory.dmp

Download

memory/5416-334-0x000001F746C20000-0x000001F746C86000-memory.dmp

Download

memory/5416-335-0x000001F746C20000-0x000001F746C86000-memory.dmp

Download

memory/5560-0-0x0000000002390000-0x00000000024A7000-memory.dmp

Download

memory/5560-1-0x00000000025E0000-0x0000000002649000-memory.dmp

Download

memory/5560-6-0x00000000025E0000-0x0000000002649000-memory.dmp

Download

memory/5560-7-0x00000000025E0000-0x0000000002649000-memory.dmp

Download

memory/5688-69-0x0000017719EA0000-0x0000017719F7E000-memory.dmp

Download

memory/5688-71-0x000001771B0D0000-0x000001771B136000-memory.dmp

Download

memory/5688-70-0x000001771B0D0000-0x000001771B136000-memory.dmp

Download

memory/6000-38-0x000001DEC7BA0000-0x000001DEC7C06000-memory.dmp

Download

memory/6000-104-0x00007FF6A73F0000-0x00007FF6A74B8000-memory.dmp

Download

memory/6000-35-0x00007FF6A73F0000-0x00007FF6A74B8000-memory.dmp

Download

memory/6000-36-0x000001DEC7BA0000-0x000001DEC7C06000-memory.dmp

Download

memory/6000-37-0x000001DEC7BA0000-0x000001DEC7C06000-memory.dmp

Download

memory/6064-87-0x00007FF7FF760000-0x00007FF7FF8C7000-memory.dmp

Download

memory/6064-85-0x0000014C77540000-0x0000014C775A6000-memory.dmp

Download

memory/6064-78-0x00007FF7FF760000-0x00007FF7FF8C7000-memory.dmp

Download

memory/6064-80-0x0000014C77540000-0x0000014C775A6000-memory.dmp

Download

memory/6064-79-0x0000014C77540000-0x0000014C775A6000-memory.dmp

Download