312cb72f5e6e0716f0a5ff4d65ad324b8476e0265e9cd678fb649b14a148594b

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_4c56274c17a73bdd58a152a278afeb82_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 932KB
Sample260806-b2bsvs1brg
SHA256 312cb72f5e6e0716f0a5ff4d65ad324b8476e0265e9cd678fb649b14a148594b
MD5 4c56274c17a73bdd58a152a278afeb82
SHA1 4ba366bcdb4541a2dfd41bae9d695f0e8d58946b
SHA512 6390d68503e69185922966e4da8f2f861148bca5f2e43c48e3e857afc6636c70189bdd6b801daf75cb47a9106fc3d4f70a25870c0251d1131cadbdf547ea8352
SSDEEP 24576:9mewsAj41grTZNChZZTyV8SlmYnKwVQc:4ljSgTSFyR1
TLSH
T11315E031FA74D432C2BF0DB22B36DB16547DB9204F6119C3E3E88E9E59602D26736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4160	alg.exe
2088	elevation_service.exe
2744	elevation_service.exe
5544	maintenanceservice.exe
3528	OSE.EXE
5224	GameInputSvc.exe
4112	GameInputSvc.exe
4372	msdtc.exe
2608	PerceptionSimulationService.exe
4224	perfhost.exe
1608	ReFsDedupSvc.exe
1188	locator.exe
4632	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_4c56274c17a73bdd58a152a278afeb82_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_4c56274c17a73bdd58a152a278afeb82_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\219a6b18238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_4c56274c17a73bdd58a152a278afeb82_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	GameInputSvc.exe
4112	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4132	2026-08-06_4c56274c17a73bdd58a152a278afeb82_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	4160	alg.exe
Token: SeDebugPrivilege	4160	alg.exe
Token: SeTakeOwnershipPrivilege	2088	elevation_service.exe
Token: SeTcbPrivilege	5224	GameInputSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1608	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 4112	5224	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-06_4c56274c17a73bdd58a152a278afeb82_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_4c56274c17a73bdd58a152a278afeb82_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2744

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3528

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4112

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2608

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4224

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1188

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:4632

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:1088

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 07ff1832442f5a0b4ec8a7988811ec60a00c027466226887de71eefbf643fe6f
MD5 902dd13fce98aecdb9619dbc0984ad2e
SHA1 9aaebad131bd5dff39d13d6ae920e1be0e6627bd
SHA512 2a354eac6de6dbc09047e835f01b46b42f80476e561451653b1519c9570567f90a96cdd44a85436436aab135bc4a2895c5fcc355a25ef1518257d0d603c47bcd
SSDEEP 49152:tqY632BuPkFKRrdE6oh7stBhuXjfS4LWxndgTSFyR1:M3q6gjBCgTS
TLSH
T1E8D59D03F2D900E8E069D178D7469533EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 8cf12984a5c19567726bf265b9b8c14021e6015438e10e6eff13f9787005033f
MD5 3ab6cffa4a5d930cf0455703b8014cd5
SHA1 55a29ca832bbe887b2f024cbcee8bd8a93006f3b
SHA512 96067df95842c3be35b6e05fe2b30dfca1bec3c89226208cb169981463411775859a4917fcc0380964a498df3410cde3cc52c0bcfa8d4d126f9ed1371fbb7c83
SSDEEP 24576:mXYCDjczA41grTZNChZZTyV8SlmYnKwVQc:WjcHgTSFyR1
TLSH
T18B05F22973D008F8ED6B827DCCA29901EA73BC554760E79B07E4D9261F237985E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 f3eeac9b6776c1f305f23a11f840f52375c62c006bd1217545479aaa581cbe04
MD5 b11f0b5264b6bd27935edbdccd67b69c
SHA1 ac1a4c593d7b50992d75527161cbd4e44cff01fc
SHA512 e75ba7ea2b13b7c3fbfb469a5fdd98ffe175da00f2ceba2086f515ed7503be44706c27a742f5a43eb361a0fa4d92293f6c1abe1d6993fd6afcc79ae31776ad34
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CpVjk0tLsrTDtNjChZxGQBTyV7g8XlmmbnKwLJr/lea:uwuuOWU1grTZNChZZTyV8SlmYnKwVQc
TLSH
T17C05F15A33A40CF8E9A6923989579536F7F2BC112A20DB1F07A0C75B6F27351BD2E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 61f464c2ee375c7535c0b4223dac7f657527bd29d529a89e945df6272272f588
MD5 4e1bca0002ad7a176483af1f1854c83e
SHA1 2aee638d8746a96c3247d64176ad9f8182f0ebf9
SHA512 06f3b2f6cd0c49269e4129e506a21b87a09782406741809c6cafc602db8c937044494139669201813eeb505b0ec278e80956bd7bd673a1a5afa5af17861e3f6b
SSDEEP 49152:o2+taZ3usBWOBr4tEGp0bqx0z+n217aau1glIgTSFyR1:5u6JmTxd2dIgTS
TLSH
T108D59D13F1DA01E8D06DD578974AA233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 611KB
SHA256 dc8a6b842aa7f57ca1ec2594dc7a4c6dc91147af867a9fec3c4f13267518a1d2
MD5 805dac157bb73d222b23e288b093fb13
SHA1 3caaeb13dda8e60287bda9fe074d7f447233f373
SHA512 9f46f348752ea12413d5a37dee326e44ef0fcdcddddc5b7618f26170af6540740ba0a753b9f490aab5645f3b93e049c38a7942f99676596eaa5843e9e719fb5d
SSDEEP 12288:Id7KgVjk0tLsrTDtNjChZxGQBTyV7g8XlmmbnKwLJr/leGrR:4h1grTZNChZZTyV8SlmYnKwVQc
TLSH
T1FFD4233A63954C60E5BC67B02C6E3C10767AFE3A5B10D8C79F84E61A7044BC9ED36746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 6dfb6ec2d4696c99527918288d469b4c6af135b3f2a372dd1984501a47701cb6
MD5 82f4dd598f2c7f47da5f6b9d3cb51097
SHA1 8658555273c1951700753e821ea9ffec86b93f9e
SHA512 7ed40147a23636431a3913c084fae373f0245aeb761709bc049c012231c88b9f5fa6935ef3717989e4d7e21c893748c4d7eb65905e8138b8d8a701d93faea1fa
SSDEEP 12288:vxGjVjk0tLsrTDtNjChZxGQBTyV7g8XlmmbnKwLJr/leGrR:JGV1grTZNChZZTyV8SlmYnKwVQc
TLSH
T1E2E4233D32E128E4C57C93755C7A3C12B9B1B9346B2068EF0FD0D536AA44BD4B639E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 e9e2b923af2bbf6533de59d320748a311411556d73914ae6c9a9190bbe37ca66
MD5 07cc5d38bb58e8788a2475eab203e428
SHA1 3dfcdf73ebae9c0526db290c918f55721034d81a
SHA512 7301a780318037efe5b2030e3a2a5f1cf89e78ee254d360d7ef100dd2692f54c2a596d8022b6c5fea1b305eb34bdd5b56b1a7c5c340780111b8e1398a9da00e9
SSDEEP 12288:5kVjk0tLsrTDtNjChZxGQBTyV7g8XlmmbnKwLJr/leGrR:5S1grTZNChZZTyV8SlmYnKwVQc
TLSH
T148D4233D22514CA0E5FC67B12C6F3C047A75EE3A6B60A8D74FC4E6176084BC9EA36785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0435a60456d0c91e739e344096f76f8d28b5d2c273d72cd483adc0f00b31c2f6
MD5 e1f859c3c5a63004b4025b480110ef83
SHA1 81cb80ac6704d990c927a2ad45fb01e9f1ba956d
SHA512 45cb401c11b904e41da9dcd3b5e863d1bd0a6bcef41073c863c6a2b44d02efe113ee17c54c565fa51dfece4e3f9fb07de4bca34d80da0d296f20934069af9bed
SSDEEP 24576:9o78z838JqH1Mzria7/mPC5l1AHteis48PkrkhdxcchZyn0jtnWI9520IUA:OgA3UqVra7/QCkr4xcchZyGWe4eA
TLSH
T18835F16566E101F5D87BD0388A434B63F6B2B4251364EFDF07A88B561F23AD14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 70c85061e2b644ed72e793964948e02842b271da2e1cdca887eaf54e7c5b7d21
MD5 a2636b493e6a2d5f22e91720f0346f89
SHA1 2b67559c9d7fc125fc5d3a11ee5c698bfb60d8a2
SHA512 71d6959f0bb47419b6b4b4c3889936a0df01953581e8ff9507551aafe9b7c433af9971029bbf2f9c1164b8b9b64104411f9329f4bdede8c257eddfece674adc0
SSDEEP 24576:IPUr+NQb1grTZNChZZTyV8SlmYnKwVQc:IJQJgTSFyR1
TLSH
T17505F12F22A81CE4E679E17D89865609F772B8621711E6CF07D0813E5E53ED8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8b99fa575d2cf3ffc7f7bde3109f45297132045f2ae5a1dfa07c5fc62b811caf
MD5 4c1902e92c70baee9e567d3bbb3106cd
SHA1 a2500a181c58e34f730c1e32ef0b976c3a326c86
SHA512 24986b3c55654ad49d69e0399766819413120830db1fdfb2e3af8adc51b4b7e0c66ae2379b1ef024ce7b835d052f468b0ba49c17ed87afd6be45fce5e6d924cc
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKgTSFyR1:NG05lO43bjgTS
TLSH
T110D5CF6E62EC11F8D1BBD17CD9C64A0BEBB23825033556CB02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7ea6e99fbd2f1bea38eedc2711b73c7a2a2349dfc9b26d2c581d6d68fb85c285
MD5 67fbcd77f1619019e490c7b4225647d0
SHA1 c74d3be2acefebdda564eaa19504a370d58ea333
SHA512 34dac4288bcd54d4a0e0631059b9731160f92722ea0157d0f4391383a9be9a618255446c788c706a30f03cf9a320f3fafa31ed710e85817b21bc6ccedd28e853
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7Fkd1grTZNChZZTyV8SlmYnKwVQc:kNc/zEOVHF4gTSFyR1
TLSH
T106858C2623E901E4F1BBE1BE89779946FA71786517308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 9805e8b973f5dddfc2145d4b624bedf836468b6ec546fa343b13449705cd4abd
MD5 42dc1a55f0c805d8ddc6993664e99fc2
SHA1 6991997aaa04e2b8171202355ebd89988a8684c3
SHA512 169b139ab43e76cb228a08db35b537d89af31c26505ef30c8065d00b97ab40e81aad899edf81652820da0b5433db76078544195038f2a9f022bec793d01a0d40
SSDEEP 24576:LJnJPbzB4SgC5l1AHteis48PkrkhdxcchZyn0jtnWI9520IUA:LJnJv6SgCkr4xcchZyGWe4eA
TLSH
T12115E03DD2A810E9D8B7C1B4811A1B6AFF31347D2B2169C719B4D5353F12EE0AA39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 864bfb597befb59ed39516cbcd65aa78e69ee3263d8fd347f53657483566f6c5
MD5 79989ef3a2ef7ebbbb4ee92648483a7c
SHA1 ef3e938542ee76d607524ea0e4c2fdefecfea6ba
SHA512 9e003e1651c261f82f8c1c7db9a7837c366a90e1b7fbf6bbb83aed8363d63f97f316a0b46f69dd60af9aa046fb4ae7883c969787b615d7554374a759310dbfae
SSDEEP 12288:X1HokZ+5ZI7njVjk0tLsrTDtNjChZxGQBTyV7g8XlmmbnKwLJr/leGrR:zZsIrV1grTZNChZZTyV8SlmYnKwVQc
TLSH
T16305012D337A10F4D0BBE13E99930902E2B2B475972159DF0BD4C57A9E93EC8B939E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 ec90b9e729f0f1e89a0bfcc19857017a8887159338fc47ed2e5c86b6fe23ac74
MD5 d2b7c306bb80a6b9ec46819b854b791a
SHA1 5ecf8145c36311d492af182c5f35f2be739cd33c
SHA512 d563e3be106859b69b7d62d3ae0983bbeb83f1cae874935c17c79548278eaf5de164f99da958f7c6c6ba5b677a0782a34bbee07e02151c692da9b91c4b8a55ba
SSDEEP 12288:MG6kytVjk0tLsrTDtNjChZxGQBTyV7g8XlmmbnKwLJr/leGrR:Ntyr1grTZNChZZTyV8SlmYnKwVQc
TLSH
T1B0F41219239418E4E6BC1378AD772910AB75BC306B2096DF4BD0E63F2E35BC4E931B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 72fa42e43c8490b6aad9f8e79a723de6609cc1d628fdc5afc5a5e6fb173d6656
MD5 d259cdf15eaede3dd09c9e1fb1477c37
SHA1 738cf77bb50ecff2990c3d4c658bf465979ea45f
SHA512 29dedf8ef76c913df08a219a88fe263d8446abb03ad0bf49709dc235351fc01c6e3b94d796a2654df504b25cb8f9c9a7306138438ce87ce19fb9f5bc5050cf9c
SSDEEP 12288:0IgCAtul1AHtedcsNa8PkrnxehdxcxShZHynn0XTb5597fqIC0hbj/Fg0IUA:zgC5l1AHteis48PkrkhdxcchZyn0jtng
TLSH
T11FD423B445F8398FCC85D07A0927AB3BAA61306DB7114DEB59E4E9371B20EC06E359C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-324-0x00007FF690C60000-0x00007FF690F03000-memory.dmp

Download

memory/108-327-0x000002020D270000-0x000002020D2D6000-memory.dmp

Download

memory/108-325-0x000002020D270000-0x000002020D2D6000-memory.dmp

Download

memory/1088-316-0x000001E647110000-0x000001E647176000-memory.dmp

Download

memory/1088-315-0x000001E647110000-0x000001E647176000-memory.dmp

Download

memory/1088-314-0x00007FF7BF060000-0x00007FF7BF113000-memory.dmp

Download

memory/1188-296-0x000002882BCB0000-0x000002882BD16000-memory.dmp

Download

memory/1188-294-0x00007FF7533D0000-0x00007FF75347E000-memory.dmp

Download

memory/1188-295-0x000002882BCB0000-0x000002882BD16000-memory.dmp

Download

memory/1608-287-0x0000019688980000-0x00000196889E6000-memory.dmp

Download

memory/1608-288-0x0000019688980000-0x00000196889E6000-memory.dmp

Download

memory/1608-286-0x00007FF6B00E0000-0x00007FF6B0824000-memory.dmp

Download

memory/2088-32-0x000001E394C20000-0x000001E394C86000-memory.dmp

Download

memory/2088-31-0x000001E394C20000-0x000001E394C86000-memory.dmp

Download

memory/2088-29-0x000001E394CB0000-0x000001E394DD7000-memory.dmp

Download

memory/2088-30-0x000001E394C20000-0x000001E394C86000-memory.dmp

Download

memory/2468-333-0x00007FF7E5A80000-0x00007FF7E5C14000-memory.dmp

Download

memory/2468-335-0x0000025C5E8D0000-0x0000025C5E936000-memory.dmp

Download

memory/2468-334-0x0000025C5E8D0000-0x0000025C5E936000-memory.dmp

Download

memory/2608-268-0x000001BDDF2C0000-0x000001BDDF326000-memory.dmp

Download

memory/2608-267-0x000001BDDF2C0000-0x000001BDDF326000-memory.dmp

Download

memory/2608-265-0x00007FF730580000-0x00007FF7306CA000-memory.dmp

Download

memory/2744-41-0x000001B8D3E80000-0x000001B8D3EE6000-memory.dmp

Download

memory/2744-40-0x000001B8D3E80000-0x000001B8D3EE6000-memory.dmp

Download

memory/2744-39-0x000001B8D3E80000-0x000001B8D3EE6000-memory.dmp

Download

memory/2744-38-0x000001B8D3C30000-0x000001B8D3D57000-memory.dmp

Download

memory/3528-60-0x000001E6ECE10000-0x000001E6ECF37000-memory.dmp

Download

memory/3528-61-0x000001E6ED070000-0x000001E6ED0D6000-memory.dmp

Download

memory/3528-63-0x000001E6ED070000-0x000001E6ED0D6000-memory.dmp

Download

memory/4112-323-0x00007FF78A1B0000-0x00007FF78A279000-memory.dmp

Download

memory/4112-254-0x0000016307EC0000-0x0000016307F26000-memory.dmp

Download

memory/4112-255-0x0000016307EC0000-0x0000016307F26000-memory.dmp

Download

memory/4112-245-0x00007FF78A1B0000-0x00007FF78A279000-memory.dmp

Download

memory/4132-26-0x0000000000C80000-0x0000000000E27000-memory.dmp

Download

memory/4132-7-0x0000000002F10000-0x0000000002F79000-memory.dmp

Download

memory/4132-6-0x0000000002F10000-0x0000000002F79000-memory.dmp

Download

memory/4132-1-0x0000000002F10000-0x0000000002F79000-memory.dmp

Download

memory/4132-0-0x0000000000C80000-0x0000000000E27000-memory.dmp

Download

memory/4160-18-0x000002994F650000-0x000002994F6B6000-memory.dmp

Download

memory/4160-17-0x000002994F650000-0x000002994F6B6000-memory.dmp

Download

memory/4160-16-0x000002994F650000-0x000002994F6B6000-memory.dmp

Download

memory/4160-15-0x00007FF618680000-0x00007FF6187A3000-memory.dmp

Download

memory/4160-47-0x00007FF618680000-0x00007FF6187A3000-memory.dmp

Download

memory/4224-274-0x0000000000400000-0x000000000054A000-memory.dmp

Download

memory/4224-280-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4224-275-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4372-250-0x0000020425D70000-0x0000020425DD6000-memory.dmp

Download

memory/4372-248-0x00007FF676480000-0x00007FF67659A000-memory.dmp

Download

memory/4372-332-0x00007FF676480000-0x00007FF67659A000-memory.dmp

Download

memory/4372-249-0x0000020425D70000-0x0000020425DD6000-memory.dmp

Download

memory/4632-304-0x00007FF63B960000-0x00007FF63BD77000-memory.dmp

Download

memory/4632-303-0x0000020C49080000-0x0000020C490E6000-memory.dmp

Download

memory/4632-305-0x0000020C49080000-0x0000020C490E6000-memory.dmp

Download

memory/5224-237-0x0000024F69580000-0x0000024F695E6000-memory.dmp

Download

memory/5224-313-0x00007FF78A1B0000-0x00007FF78A279000-memory.dmp

Download

memory/5224-238-0x0000024F69580000-0x0000024F695E6000-memory.dmp

Download

memory/5224-236-0x00007FF78A1B0000-0x00007FF78A279000-memory.dmp

Download

memory/5544-49-0x00000168AD540000-0x00000168AD5A6000-memory.dmp

Download

memory/5544-57-0x00007FF78B940000-0x00007FF78BAA8000-memory.dmp

Download

memory/5544-55-0x00000168AD540000-0x00000168AD5A6000-memory.dmp

Download

memory/5544-50-0x00000168AD540000-0x00000168AD5A6000-memory.dmp

Download

memory/5544-48-0x00007FF78B940000-0x00007FF78BAA8000-memory.dmp

Download