Overview

overview

8

Static

static

3

2026-08-02...ay.exe

windows10-2004-x64

8

2026-08-02...ay.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 19:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_032a1386d721ccc4cd61f52ad488338a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
  • Size 562KB
  • Sample260802-yj1ets1cmf
  • SHA256 44e774a84431e223df0e6596a33ebb5338389059599fecb96581d8069a435549
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_032a1386d721ccc4cd61f52ad488338a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_032a1386d721ccc4cd61f52ad488338a_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2868
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:4116
  • C:\Windows\System32\GameInputSvc.exe
    C:\Windows\System32\GameInputSvc.exe
    1⤵
    • Executes dropped EXE
    PID:4976
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4644
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:5608
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2768
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    PID:4808
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:5316
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:3316
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:2700
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:1332
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    PID:4244
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:2236
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    PID:4788
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:5016
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:2264
  • C:\Windows\system32\TieringEngineService.exe
    C:\Windows\system32\TieringEngineService.exe
    1⤵
    • Executes dropped EXE
    PID:5768
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    PID:200
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:5592
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    PID:5704
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    PID:108
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:5840
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    PID:1184

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.6MB
        • SHA256 ebbc299b8eb781f64729b53980d64f70ada9b119c005e601e185835200e74829
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 658KB
        • SHA256 05b52148f0d7b55b4432d9e8f52b6076092b7263bc1961cc12530f4728058ea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 637KB
        • SHA256 aeeb188989e08b70501cb5979d48a9881d4fb60e5f7658e82da573b3618c9278
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.6MB
        • SHA256 9bf779eeb5d4757c3748d091aa0e05b64ce49efbbc26bbb2ae54ca45279e218d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 416KB
        • SHA256 ad1c67a4991fba336a113947a910e83ef06c84ce25765ad380d7f49cad398a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.2MB
        • SHA256 2c6d53877640ecc79ec3f968e0ef994c8a4cef8d74accf334f91447fe1b7e819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 464KB
        • SHA256 6a202108882f4b55595354f57218abb17cf3280d948f63dd65e76f9fcbfa9894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 428KB
        • SHA256 9b2b706a08209c6d5613de019050bb9842661c09e4f2d8b1a60ccdadb0cb3efd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 944KB
        • SHA256 2009c757599ea888bf88badff90a70795e79d234669187a26d085e41abd4ce93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 632KB
        • SHA256 7af8b357b98f388128e52d69bf6651efa6b6627fcd71d77dc599d7e368405457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.5MB
        • SHA256 38f301879e69b636eec2f9e748c0b0c9225f44ee3ea651aa741183a35dce3dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.3MB
        • SHA256 eb886fb82dbc3c7a973571ddbb8de5664a88d04b0962ccdbcf27d3d1935dbe72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.5MB
        • SHA256 4cd0abc3cbce3ba93a386cbda2b6d2ef733a62f95c3fe0294684068446048863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 736KB
        • SHA256 c1495fb7c99f7d96683c3b69d0f87e241941b9a3345c98040bb42cd6aa6b4f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 1.8MB
        • SHA256 4218a486d3123bc35d4641c73fab764dcd09fa1e7c0e85e7bf3fa15931a97d2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 580KB
        • SHA256 6e8e066f98149fb0e7ed4475fa557fbf31225707690d81da5ac4338b1b0671da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 564KB
        • SHA256 cbf7332eaf5af7ebe012509f29842d5887ab87280a00943e7db738f6281acf31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 572KB
        • SHA256 0bdc876200aa85283dcddef02fb8c1017aa66e172b9a34fb8334a86668e29a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 436KB
        • SHA256 622e887e0fdf0b4d02f86a4d23d5c712afbdf3f0a880bf7c3e2cbd8a4b926aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.0MB
        • SHA256 4e8fce00dcbd853cf92cc77b6210c0ca4de140fcc8239fb489cd90001693be84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 596KB
        • SHA256 3f1c0fe8911b3485f389d49890118ea59f0ad5b0edf27052956d00e5bb282de8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 1.9MB
        • SHA256 c38fb0ccc5574bd8d5c669515054afdb68c918089d43fc25ac1b975c23c9b656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1332-85-0x0000000000630000-0x00000000006CC000-memory.dmp
        Download

        memory/2868-4-0x0000000000750000-0x0000000000812000-memory.dmp
        Download

        memory/2868-5-0x0000000000750000-0x0000000000812000-memory.dmp
        Download

        memory/2868-2-0x00000000007E1000-0x0000000000812000-memory.dmp
        Download

        memory/2868-0-0x00000000007E1000-0x0000000000812000-memory.dmp
        Download

        memory/2868-1-0x0000000000750000-0x0000000000812000-memory.dmp
        Download