2952114a8ba25f6861b874bc25b06d09863ba73933af93a031d945dfc6e6b7f6

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_30f33ff18c302f9242704c6853efc454_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 860KB
Sample260806-b6fbvafc23
SHA256 2952114a8ba25f6861b874bc25b06d09863ba73933af93a031d945dfc6e6b7f6
MD5 30f33ff18c302f9242704c6853efc454
SHA1 ed168970de783fa6c1ce762382253c56f26639c8
SHA512 0011fef0f4b4f8c8dde882da477fcaf3e9bd54a723376063f4a5704d6b76062bc77d26fb9a3476d275feff6cbaf1834715d1f57a79d3895d560b4ff3e324247f
SSDEEP 24576:uxcVCzdm2SrGxLOPFuqpft56XUo9gz5CEAwdhg:DOY2Sr+sumEzaz7a
TLSH
T185150222B591C472F5B309321CB8AAA15ABDB9210932CE7F13D00E6DDE75681D639F73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4336	alg.exe
3444	elevation_service.exe
2748	elevation_service.exe
800	maintenanceservice.exe
2272	OSE.EXE
1880	GameInputSvc.exe
1936	GameInputSvc.exe
3032	msdtc.exe
3876	PerceptionSimulationService.exe
2556	perfhost.exe
2428	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_30f33ff18c302f9242704c6853efc454_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_30f33ff18c302f9242704c6853efc454_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2cb246bc24febf98.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_30f33ff18c302f9242704c6853efc454_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	GameInputSvc.exe
1936	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2508	2026-08-06_30f33ff18c302f9242704c6853efc454_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4336	alg.exe
Token: SeDebugPrivilege	4336	alg.exe
Token: SeTakeOwnershipPrivilege	3444	elevation_service.exe
Token: SeTcbPrivilege	1880	GameInputSvc.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2428	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1936	1880	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-06_30f33ff18c302f9242704c6853efc454_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_30f33ff18c302f9242704c6853efc454_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2748

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2272

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1936

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3032

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3876

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4332

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:3512

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1672

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1252

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2274218ecfd4a40a3578e3a0f76085eade3c500862048c1a2c51a44f8497d052
MD5 6a288f50706fd18b929620219a3093a3
SHA1 6ce1977366e11f5f7580879b5ceabe889523a133
SHA512 50301a60872b2e8588317d6c02f4046647f9e870626c9d7154d37d5ef8ab5112cd9bbb40477db083302b0bc7d855dde86cdd545138e37ee2027eaf4a61792518
SSDEEP 49152:K11632BuPkFKRrdE6oh7stBhuXjfS4LWxnrEumEzaz7a:H3q6gjBCh9zE
TLSH
T17ED59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 f2bba1c36b862d657cd05212803f357b2985b9bbd0c69056b07f2961a16c42ab
MD5 ad946e3b95bd5bb0052dd74c2a60d892
SHA1 5a403151aa4d08a77049125ca540f636a284c2b9
SHA512 adede77c98131ebcecbbfa182bc4e13e3e111af19fdb8f76aea1483b49a019361e4ff9ba4d54f329ec981771a8616c053dc571b81fd2897e0b4b07d2b5d74337
SSDEEP 24576:PXYZDAczArfFuqpft56XUo9gz5CEAwdhg:oAccNumEzaz7a
TLSH
T183050129B39444F9EC67823DCCA29405EB73B8414764E79B03E09A395F237C95E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 f3b2dfae6add88b6c4769e9ca8667908059b442afea75311c4b3e60ba7d69f8c
MD5 772e9f0d38eadbcce927ea575ea1b1ce
SHA1 eabe1e365f403f746b7f620671d3fcb0bbfbf4ac
SHA512 1fae9b5a2acff01d37d6315fa778568d83fbb8eb4b89d14879b946d34d877b372d7aeda0a2de100db128b4c7e8dcdbcfcd3f642b5a983be79a7c3ff8b4670c3a
SSDEEP 12288:Vmw5HEjsChNnBFgl0WDm+CsF5QqpftUGdKVi0XUhERR3A+XyJB5CiacL7lSlVgVa:Qwu+OWfFuqpft56XUo9gz5CEAwdhg
TLSH
T15605F14A72A41CF9E9A396398557D436F7F2B8012A25CB1F0360CB5B6F37351AD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cd305733093530239572fae24bbdbe141ac3061561b3d8c1b868a3da33bf2102
MD5 f0ad3a42055f7ecb9af9ec1063fe8a2d
SHA1 f20839d457c52e8c9c14e0b6521a4a4af55874d5
SHA512 423c4f34a922b8cbc337e6b33b91e60595daa37e94134aef585d7f385fbd6e79b4e0022575560ab717ff4b035beaaa8f16a36b34d2d3116c82f70ec164fb7abf
SSDEEP 49152:a7+taZ3usBWOBr4tEGp0bqx0z+n217aau1glfumEzaz7a:Ou6JmTxd2dW9zE
TLSH
T17AD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 32cd62d96bf1a8966d71e407b2e7d80c6f0da6d85fe05913a9d34be6aa66091c
MD5 334e0112f20288a0d6646c568b47a6b1
SHA1 9bbcb73b452f68591b8314ddf34596b076bcdee0
SHA512 27643d874b6ba44a1474db1829df87d953e28579ff242545d94952885e87901514b4ad316b6da551e9d867d99a275d19809626526e15f1586f5e7e12bd608250
SSDEEP 12288:cM7lF5QqpftUGdKVi0XUhERR3A+XyJB5CiacL7lSlVgVZdhYyal:1lFuqpft56XUo9gz5CEAwdhg
TLSH
T123D423BBD10CE136F4B2AE31783EB4581B11FA109B15C6DBA4515F2DA1E5AC3CDB0A93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 31dda06c4d2eef168884ba66bef5796394a2750e45bddf15c54850ae9d85ec68
MD5 9a9114a6d1a1bc041850c06cf5d7e03b
SHA1 0a9ed48c3cc8c7e37c1f1debefe04a9daac5d769
SHA512 0c1365f918689250defaaab8af5a8e05068ac5d8058a1d16045dac9de381f14d15503b594d313ed0c6e7165cb825bd7b18e542575f99f1fed42b20a330911266
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYLFuqpft56XUo9gz5CEAwdhg:agb4mBIBhGFYumEzaz7a
TLSH
T1BF659E1E22EC02F5E0F6E2B89DAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 ec4e5a004616aae6e5b426d57d8f14ab4f2065f4a4a3aede5814f544b07d2210
MD5 686406f5bc121fe0c11f75c402fd3511
SHA1 76b3bfb6d44560dd3b32750c77f9056543d96acd
SHA512 40398f2976314f7998ed4f897023f2f8212fff2faf4376624f2687d6836314b92819f9964c8bf209d97bc14325094575a91aa06458321683e7419a445fd2d646
SSDEEP 12288:H8GCF5QqpftUGdKVi0XUhERR3A+XyJB5CiacL7lSlVgVZdhYyal:cGCFuqpft56XUo9gz5CEAwdhg
TLSH
T14AE4237EB0A8B0B8C476DA35A83574967BB07510972557FF04E0DE38C3A9AD2AE34DC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 1eef3af32f09965b326dec7a083edcedd31e367878276a7591cc385962696b30
MD5 3da5e51f064079ff6ddeef777b34369a
SHA1 88bcac652de6b35dca38fab3b31da1fe01304b06
SHA512 1ae0769aca5cc0f88a247285e92808f8a3e333562f3671eede1a7f4ae9c95c582a6c5e12cd45f3d39765d7379219eb49c475c43beff935c8aed5c1ac2a647a6d
SSDEEP 12288:XRF5QqpftUGdKVi0XUhERR3A+XyJB5CiacL7lSlVgVZdhYyal:XRFuqpft56XUo9gz5CEAwdhg
TLSH
T118D423FFD008F135E4E2AE35743678891B50E600976B97EB50A15F2D91DABC38DB09D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 bdbbaa864ddf5fbb23a107d611cac7617bdafcec9294dc85dc4b9228e8b07209
MD5 a3e81cab714f4efe37812a2d7984945b
SHA1 79b165f54dadc50b6da6ad0e7779942cd24f952b
SHA512 1d775857e9168e3774eebf387dfcf296d4f539e342f4106311b218356ce95748327e10e9a89bb645f05818130be5099654c375120b63d75b40f48e221eeb9b50
SSDEEP 24576:ruj8U8lZJqH1l6ria7/mjFuqpft56XUo9gz5CEAwdhg:6Ibl/qVRa7/oumEzaz7a
TLSH
T1F635F166B6E001F1D477E138898646A3F7B2B4210364EFDF06A88B551F23AD54F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 b15490ccb98f365bad29914f214eb085b9bcff0a3959715bc543d9b1e8bb5a7b
MD5 520ce88bbd018bff6e3222a81c358b61
SHA1 03c3552efc38aa1c0c827df2347caaae60f41390
SHA512 2644116cdb3c00aa4b897241e0cc9bc68b0786f53ab9633f747c2c9c0390cba4703237f0db524f2ef3c06a462a23d9c62ce34b48be844f169667c59327b71234
SSDEEP 12288:5HvUrBFrEjwaQKF5QqpftUGdKVi0XUhERR3A+XyJB5CiacL7lSlVgVZdhYyal:5PUr+NQKFuqpft56XUo9gz5CEAwdhg
TLSH
T13A05F16F62AC18E5E676E13D8982860DF771B4621712D3CF02E0817E4B67ED8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 6a0fcd82d0314d692d3c10274f8bb385d5bea16f023faa8792482891fa430b4b
MD5 c62550901b61a5f4a5cb22f166b9fd47
SHA1 80838875bd8e422634800e0d36ef529309d0b1e6
SHA512 ff5b04b5455df43fea175d3e78db3b86799f791efe582c529628eb42bde2006d25c591191ccd2493abb2aa2ae5767d332c7f017b96b65cef434624f1e9482f01
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfumEzaz7a:aG05lO43bd9zE
TLSH
T1FBD5CF6E62EC11F9D0BBD17CD9864A0BEBB23415033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fd42c559664ac50555d6f06a570baaf8fec9b95c5666977562cca82edc8fcad2
MD5 ea1f1dde4640231b24ee8026c56a8ca2
SHA1 64d4e099a266287cedbadc9c16206c76d607db40
SHA512 f452699f2f5b59508fea82a4847f84b2ecc78f2a3c40313b1a945bde56890c0a96bbaefbc4d11dd92ed189f8d43db41f648dbf8933dd457bcd4fd692962ce808
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkIFuqpft56XUo9gz5CEAwdhg:cNc/zEOVHFdumEzaz7a
TLSH
T1DD858C2622E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 c3a0fc328b9ee35fa345c8c956fe8d2f6b596ee28afa546413ae3937bc5e356f
MD5 3e90150fb963abd88fbb4465f5e70343
SHA1 c9270846399d98d704f5750f6a95ea559bc6e839
SHA512 0fb24b69450f33741f8381c901927c67e27cc668f12c71436cde4e8887478ac34f5e0198ec448c5b91f6d76c1ea23d39683587d07eb460ca668ef9039fe86fa3
SSDEEP 24576:OJnJPbzB4SHhFuqpft56XUo9gz5CEAwdhg:OJnJv6SHHumEzaz7a
TLSH
T14B15E13DD2A810E8E4B7C274811A1A5AFF31386D2F2669CB19B4D5343F52FD0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 a67a81f92fe1154649c7f71f16dfa42a0f49ac5e14496b76b45a114c1b3d36bd
MD5 3e2b116e247840474158945536a87d60
SHA1 8e4614a7b4f18b2f13303d4634509bd8c4498be8
SHA512 ec80013acd1fcd27d1d6e78cd02e91a22f6faa125c6c2356cc43c277403d35e42461a159fcaa4a02b1d5a557a6420f794da7354de2aea4eee4feabcac2173674
SSDEEP 12288:M1HCkij5ZI7IF5QqpftUGdKVi0XUhERR3A+XyJB5CiacL7lSlVgVZdhYyal:+iDI0Fuqpft56XUo9gz5CEAwdhg
TLSH
T1F8F4016D637910B9D0A7D03E95930446D3B2B17187225ADF06E0CA7D9FA3EC9BD38E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 45d96fe373ef407d433bdaee876622fd6863e7ea8234b65481e83f150897cc5e
MD5 b9775f482ceeb805b61153da355cc2c1
SHA1 d506035745c62c59367fbbe312a93705f1bcc714
SHA512 3059ca759b68ad8fd4a2da960c73fbb95f668d2db62ebc73dab50aca15ca617715fd70fb5da4e39d5be8955a1611c04a01e2a98115fa78c004ece1bfe4a26288
SSDEEP 12288:iG6ky5F5QqpftUGdKVi0XUhERR3A+XyJB5CiacL7lSlVgVZdhYyal:Lty5Fuqpft56XUo9gz5CEAwdhg
TLSH
T1D5F42359A348B0A4F9B65634A97390944F30FC109B2297DF50E0EB3E6B76BC1AD70F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 a7b96b1b9a745cd24588902ecb3301eacdd465b822b388132557a4202c1bb45a
MD5 96d92790c427e189e77a386bcf83563f
SHA1 e76add992ecdc4371068dce6d8e1a40f209259df
SHA512 85fbcc90552c14e66c1f842cb69772c00bccb9083144e4d6546b2ef8cf3b3605c853000e1792180ef9feeaee767784b814e8c352816d099c9119122052b56d70
SSDEEP 12288:+qMYF5QqpftUGdKVi0XUhERR3A+XyJB5CiacL7lSlVgVZdhYyal:vTFuqpft56XUo9gz5CEAwdhg
TLSH
T159D423FEE008F175D8A2EE35742678895760B5105B2B97EF54E09F38D39A6C38DB0D82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 384KB
SHA256 60e58b66bd3fdb90617fa816aa842cea307be93404e570f860f4b1b33dd83c6f
MD5 f025b95a36345deeb63815c300208680
SHA1 ead98987a9ae35e36dc2b92dc952e6e1fc2fdc82
SHA512 39c2b2568a2117f48e51bb33427e230c901823fc5a2b47b96fe9f9e7cebcdbb3c47c862584e1d53b9869414beea457dddbcbf2f0ec3f08afd2ea7c81387a728f
SSDEEP 6144:p7RgyGy5Z1QSLI+lqoDyMpJHS433NhcMV/VUjSTrGNPyCSZB8PTuFc:pVgyTZyFDK3tT5Tr7aV
TLSH
T1D784D32D27FA11E9D175C138C9024156E6B37035A3922AEF3991C07ACE1FEE96E79F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-48-0x000001B5E30B0000-0x000001B5E3116000-memory.dmp

Download

memory/800-46-0x00007FF76CBD0000-0x00007FF76CD37000-memory.dmp

Download

memory/800-47-0x000001B5E30B0000-0x000001B5E3116000-memory.dmp

Download

memory/800-53-0x000001B5E30B0000-0x000001B5E3116000-memory.dmp

Download

memory/800-55-0x00007FF76CBD0000-0x00007FF76CD37000-memory.dmp

Download

memory/1252-345-0x000001AC633A0000-0x000001AC63406000-memory.dmp

Download

memory/1252-340-0x000001AC633A0000-0x000001AC63406000-memory.dmp

Download

memory/1252-341-0x000001AC633A0000-0x000001AC63406000-memory.dmp

Download

memory/1672-322-0x00007FF7EB770000-0x00007FF7EBA12000-memory.dmp

Download

memory/1672-323-0x000001D8D0C70000-0x000001D8D0CD6000-memory.dmp

Download

memory/1672-324-0x000001D8D0C70000-0x000001D8D0CD6000-memory.dmp

Download

memory/1880-235-0x00007FF70E420000-0x00007FF70E4E8000-memory.dmp

Download

memory/1880-320-0x00007FF70E420000-0x00007FF70E4E8000-memory.dmp

Download

memory/1880-236-0x000002667F010000-0x000002667F076000-memory.dmp

Download

memory/1880-237-0x000002667F010000-0x000002667F076000-memory.dmp

Download

memory/1936-330-0x00007FF70E420000-0x00007FF70E4E8000-memory.dmp

Download

memory/1936-244-0x00007FF70E420000-0x00007FF70E4E8000-memory.dmp

Download

memory/1936-246-0x0000026B5BB40000-0x0000026B5BBA6000-memory.dmp

Download

memory/1936-248-0x0000026B5BB40000-0x0000026B5BBA6000-memory.dmp

Download

memory/2272-60-0x0000022361980000-0x00000223619E6000-memory.dmp

Download

memory/2272-59-0x0000022361980000-0x00000223619E6000-memory.dmp

Download

memory/2272-58-0x00000223616D0000-0x000002236181F000-memory.dmp

Download

memory/2428-287-0x000001CC39080000-0x000001CC390E6000-memory.dmp

Download

memory/2428-286-0x000001CC39080000-0x000001CC390E6000-memory.dmp

Download

memory/2428-285-0x00007FF7146A0000-0x00007FF714DE3000-memory.dmp

Download

memory/2496-333-0x000001C8B6810000-0x000001C8B6876000-memory.dmp

Download

memory/2496-332-0x000001C8B6810000-0x000001C8B6876000-memory.dmp

Download

memory/2496-331-0x00007FF6404B0000-0x00007FF640644000-memory.dmp

Download

memory/2508-0-0x0000000002920000-0x0000000002A09000-memory.dmp

Download

memory/2508-1-0x0000000002A60000-0x0000000002AC9000-memory.dmp

Download

memory/2508-7-0x0000000002A60000-0x0000000002AC9000-memory.dmp

Download

memory/2556-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2556-279-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/2556-274-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/2748-38-0x000001BADF220000-0x000001BADF286000-memory.dmp

Download

memory/2748-39-0x000001BADF220000-0x000001BADF286000-memory.dmp

Download

memory/2748-40-0x000001BADF220000-0x000001BADF286000-memory.dmp

Download

memory/2748-37-0x000001BADF000000-0x000001BADF14F000-memory.dmp

Download

memory/3032-253-0x0000022538030000-0x0000022538096000-memory.dmp

Download

memory/3032-254-0x0000022538030000-0x0000022538096000-memory.dmp

Download

memory/3032-339-0x00007FF734BA0000-0x00007FF734CB9000-memory.dmp

Download

memory/3032-249-0x00007FF734BA0000-0x00007FF734CB9000-memory.dmp

Download

memory/3260-352-0x00000160BBD60000-0x00000160BBDC6000-memory.dmp

Download

memory/3444-29-0x000001E13F030000-0x000001E13F096000-memory.dmp

Download

memory/3444-31-0x000001E13F030000-0x000001E13F096000-memory.dmp

Download

memory/3444-30-0x000001E13F030000-0x000001E13F096000-memory.dmp

Download

memory/3444-28-0x000001E13EDC0000-0x000001E13EF0F000-memory.dmp

Download

memory/3512-302-0x000001FFA5A10000-0x000001FFA5A76000-memory.dmp

Download

memory/3512-303-0x00007FF70B350000-0x00007FF70B766000-memory.dmp

Download

memory/3512-304-0x000001FFA5A10000-0x000001FFA5A76000-memory.dmp

Download

memory/3876-266-0x0000016367170000-0x00000163671D6000-memory.dmp

Download

memory/3876-264-0x00007FF76DD90000-0x00007FF76DED9000-memory.dmp

Download

memory/3876-349-0x00007FF76DD90000-0x00007FF76DED9000-memory.dmp

Download

memory/3876-267-0x0000016367170000-0x00000163671D6000-memory.dmp

Download

memory/4332-296-0x000001EA47A00000-0x000001EA47A66000-memory.dmp

Download

memory/4332-294-0x000001EA47A00000-0x000001EA47A66000-memory.dmp

Download

memory/4332-293-0x00007FF6E12C0000-0x00007FF6E136D000-memory.dmp

Download

memory/4336-16-0x000001E993F10000-0x000001E993F76000-memory.dmp

Download

memory/4336-18-0x000001E993F10000-0x000001E993F76000-memory.dmp

Download

memory/4336-17-0x000001E993F10000-0x000001E993F76000-memory.dmp

Download

memory/4336-15-0x00007FF648C40000-0x00007FF648D62000-memory.dmp

Download

memory/4336-65-0x00007FF648C40000-0x00007FF648D62000-memory.dmp

Download

memory/4828-312-0x0000021998E90000-0x0000021998EF6000-memory.dmp

Download

memory/4828-313-0x00007FF7415E0000-0x00007FF741693000-memory.dmp

Download

memory/4828-314-0x0000021998E90000-0x0000021998EF6000-memory.dmp

Download