fb1f227f2258a59436be3e31312ebddc7cf245894c677177083b59ca600d533a

Analysis

max time kernel
145s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_c62a26a82fd40ed1010e45a2f7b80a0e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 783KB
Sample260808-c9bcqs1yay
SHA256 fb1f227f2258a59436be3e31312ebddc7cf245894c677177083b59ca600d533a
MD5 c62a26a82fd40ed1010e45a2f7b80a0e
SHA1 958c05107e0a3e3f758619732a2e5894edba3081
SHA512 dae81d46b8da8e25493d5ce0b99eaf89cd95a2fb226ebc1b57f8d120c94fe0952babec22fe032bdc03650cfc4bc12286dd645f631a411090f315adb7d7429ba0
SSDEEP 24576:yrUr+I4rvxLxT7Jckdwi6i9bNrqq4E41WFpW3oRos:br4rJLB7Jckdwi3N7+WTW3
TLSH
T1B005010175D380B2D1B3463109F8EAB0AAFDBD710E21AE7B23D4577D5E742C1962AE72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1412	alg.exe
4376	elevation_service.exe
4336	elevation_service.exe
1508	maintenanceservice.exe
1376	OSE.EXE
6092	GameInputSvc.exe
1276	GameInputSvc.exe
1028	msdtc.exe
4828	PerceptionSimulationService.exe
1924	perfhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_c62a26a82fd40ed1010e45a2f7b80a0e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_c62a26a82fd40ed1010e45a2f7b80a0e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3c72c5478f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_c62a26a82fd40ed1010e45a2f7b80a0e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1276	GameInputSvc.exe
1276	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	520	2026-08-08_c62a26a82fd40ed1010e45a2f7b80a0e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	1412	alg.exe
Token: SeDebugPrivilege	1412	alg.exe
Token: SeTakeOwnershipPrivilege	4376	elevation_service.exe
Token: SeTcbPrivilege	6092	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6092 wrote to memory of 1276	6092	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c62a26a82fd40ed1010e45a2f7b80a0e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c62a26a82fd40ed1010e45a2f7b80a0e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:520

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4336

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1508

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6092
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1276

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1028

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:2052

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:5140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:2700

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5316

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5744

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3716

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:5860

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 268aaa4a9a2dcc1a80fd1134afc22a89611f3d466ffcf559a8a682ba7819679d
MD5 092822cc7116e4ed559be47eb7d7594d
SHA1 15854341812e0fce4d511da28f98c781d9d623fd
SHA512 0cd5f7da5d46582184b6e1710ec67975d19f3caae8d5b0107152ea9b7798df580e737c95c3a2a5538c3e437f71aefc9a8bf437afc595712e8b69bc9f8a6d2c0d
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxnJ7Jckdwi3N7+WTW3:L3q6gjB4Pdwi3Q
TLSH
T144D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 54b9dfc2fdc71b29a4b87db05db753e251c355b595a0cdd41463cff8fd467482
MD5 88067def8936c37f8798753ce68ed787
SHA1 60007061fb997fb06e91f483266e67cd208b7a37
SHA512 4b0ac39521f2c71d525438c179ac0e12fe4ac0168b86e4f0100e3413391ea7e2f795375ce3862fe4007887e84375bb5c74b1df94cd91fdeea68adfc027b2a345
SSDEEP 24576:TXYHDxczAkT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xcn7Jckdwi3N7+WTW3
TLSH
T1E1050128A3E509F9ED67C239C9B2C511EA7278514760FB8B03E496651F233846E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 a6b692e6bd281855991012b4f7bee2c870f7b304b77e45bcf1ca72a0442c6826
MD5 48ea9307933fc380ccdf94c898d3822c
SHA1 677cf670a2d55f8e0c22e7a1a87e55772af48c00
SHA512 8d67a911ff78c257b7d4fe50d8817ba877d11fe7a56b591ae468f3bf9629ab6d125dbe016cd0610bce18e0178e599b84736c78c60e99cad8cab8509b6eef3807
SSDEEP 24576:Owu+OW6T7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOr7Jckdwi3N7+WTW3
TLSH
T11505F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b804c24b6f4f3d6c3ebfe7265860eb44ccd88265f855ded38641032a47cc28be
MD5 a86ad3de43588d6a3024e33b6b0194e8
SHA1 78fda60ad13ed8deb3c135be8dae8f942bf88eba
SHA512 d45176f6a2b2ab4cd8ff9efc145e993c090bab58aa2703459c2903d512d7e9b9e9a4e5556cb60e10b87fe9f852ff1b7b1658e2cd35e8c3a10f17643c1779dad0
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1glb7Jckdwi3N7+WTW3:Hu6JmTxd2dBPdwi3Q
TLSH
T107D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 adde260094d1fe8b65391d919414d47b1b249a78385aca567286d58c09749012
MD5 f5dd0c13e935357a55fc4ea02981aa0b
SHA1 4c645e5a9f13416f32100cc72da75462cb1aa376
SHA512 8ad4bf62dfb01697c8302c1f439e67df620a436deee82d9b1ba88cc8e9c1377195673de856154c4b2f1a2beb4f0bf61a90bb1a9d0abf3c33f439c53031c0fa00
SSDEEP 12288:cM7hT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:hhT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T160D42308C75D5A5BE277E231823DD2A4F66C3F526F15FA87874462E054293807BABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cbc29a7a44026de9085dc8b4cebc1aeac4b163aa640af98e31b6c43ea50cc09c
MD5 8b20af2179974221da22148ef8cc843b
SHA1 1c6aafef76f9168bdf0cf8d1d2a05b04f88af6bc
SHA512 c59ec61d2c0dd6b487258aafa130f6cda5bf76403178d8878641ce5bb24c32d4ac859466585ef24cd46bf15bc04d21f10cc1a5975c7efe525098bfca9c251020
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYbT7Jckdwi6i9bNrqq4E41WFpW3oRos:Dgb4mBIBhGFA7Jckdwi3N7+WTW3
TLSH
T14F65AE1E22EC02F5E0FAE2B8CDAA4417D6B278161731D2DF1251426D2F3BEE49D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 b8b3c882cc9b26ca1345eb3bac53f1bccd6cb9ec8b4c0948218d13b188e4bb2f
MD5 7d46ebfd66e43d16b858712de3d0b9a1
SHA1 04339eed1009922657577e814865798186f5c952
SHA512 f03e34351057b70e79d0fd43680a83d916be4342b5e5ac0db571a6b31875f804d7bc48274e90ea4b0ce4e574d462bc501f2e268333511c8610084713414bdf5a
SSDEEP 12288:f9GlT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:1GlT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1DCE4230C61AA35E9C237D335853DE5A5F9F03A512B147AEF06D0A2B09B193D0777EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 d6f9cb6b49127a75b8f8e255b7e03892371c84eeaa6b949d2c807f7c2623b521
MD5 726eb59735c37e7ff91477dbfe03fff2
SHA1 d589c93f5879008feb2e3e239c898c91d250cf86
SHA512 7e0ef0138247e3e8f82f448e69e98593f422231398917586f25a71d9e7dab6d4b3fa659417e2dc5908484ec8a066f31fb2f6e801a9f15e74fa9521fcf3f4f6ae
SSDEEP 12288:ZxT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZxT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F4D4234C9259469BD363E231833EE694FAA82B023B65BBC3429472A0555D3C077BFF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 798b532c6c1478cf0cb139f68e16087df9dabd5b85ee4c068c30ecf3e9415d13
MD5 3c2438b640e2a035790c84709186e5e4
SHA1 23fc254afcb3a9838ae6294ed1a100c59de731af
SHA512 407b258705467bc70e730cd474a2cf6fc057cfd3f7d755e4db46675e6eb07d27ebcf54b8adbf3ba1282e19e7efd9da2910120a0de2f6719ba0dfa892c37dbec1
SSDEEP 24576:ogi8u8FpJqH1sCrDC7/mtT7Jckdwi6i9bNrqq4E41WFpW3oRos:9RZFPqVbC7/m7Jckdwi3N7+WTW3
TLSH
T1EF35F165A6E102F1D477D1388A9686A3F6B1B8211364FFDF07A88B511F236D04B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 3ebb737efee57ff79a7148df0333c567965e8ad7c21f8ca4f626f45cd146dd1e
MD5 f92281a436469ac0cee29ba085fa0770
SHA1 184263a147a9f7dbf8094563ec8872268c7b4c77
SHA512 f4e2b80d2961a7e860a9d1d2adc1d675c27a31db4d615705cdcf6514891b5e26084347c4bfc366c264237845eb4e1bc5577432f23879aef2d91dfc26e0429488
SSDEEP 24576:vPUr+NQvT7Jckdwi6i9bNrqq4E41WFpW3oRos:vJQr7Jckdwi3N7+WTW3
TLSH
T13305F11E62AC18E5E677E13D86568719F77178621712E2CF02E0817E4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 43bd206f7e6620ce68c3c31131fae7e19d7da8c17531bd0b0f933d7aa5d60597
MD5 8e1b4f915eedbf8947b03584235772cb
SHA1 443d3d5f09dba1f6e97f3659a5c78b861ea7129e
SHA512 9ceffe29f4c17c763db3ccc5f64a3fafec7bcd1cbeb33e6dbf9de5e769482cc42783fb4973dfbff0e3126e3b28a7edcade83105d05da1a0b5ebb160153c0dbe3
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj1l7Jckdwi3N7+WTW3:SG05lO43bWjPdwi3Q
TLSH
T1A0D5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF0667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5e5829218857d55aee4fd44c1a2748cdf916a150e013d8433466a5e2e268bdda
MD5 9c3843cadd41c371ffeca2357f4a774f
SHA1 bea5e33050dfc87579f8a39d95ad23fb3dc23e99
SHA512 eea81f71e4751e680095004c3310172111d64e6872936019a738bde3850c72ad016619e797847bc6b9c469406d25faf1827f75891b5d5793a32963362ee7612b
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkxT7Jckdwi6i9bNrqq4E41WFpW3oRos:tNc/zEOVHFK7Jckdwi3N7+WTW3
TLSH
T1D6858C1623E901E4F1BBE1BE897B9546FAB1786517309ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 001112678d58a34a42b7808488c7fd1589bf90b34b27cf9293834a6c484076cc
MD5 bea0116c617ddf54e9add600c5a4df98
SHA1 16e3309d0b41d7935d28a751203a62e65c1f9c85
SHA512 06d51cd8219e0315187441c91b7d7ee210a8441c5851bf2fc8197bf2d1f41eed630dfe5cb46fe1ff62908c5761815e887aa84fdc9e51bb507744a918e030624d
SSDEEP 24576:hJnJPbzB4SvT7Jckdwi6i9bNrqq4E41WFpW3oRos:hJnJv6Sr7Jckdwi3N7+WTW3
TLSH
T13415E02CD2A810E9E4B7C2B4811A1799FF71386D2F2669C719B4D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 37fd782f98d710b91e438a8f0aa4da1af9b197293f93c3a5e8a039718394bf28
MD5 abae2599ca6556dfa6f3b41c623579d5
SHA1 d1f1977ed2703be369c0f80f33d9aa24b25a49ba
SHA512 62495b1f8808c38d4c5d9318987aa58b556f62e0f6729ad92576608a88cccf6ad3ce9f7abf552588e2a22b8defbd3bef18d1239cc9ba4949e6fe905654dc4d6d
SSDEEP 24576:gLDInnT7Jckdwi6i9bNrqq4E41WFpW3oRos:gLDInT7Jckdwi3N7+WTW3
TLSH
T1E7F4010C637A11FAD167D03EC6974141E2B2B57197226ACF07D4C1B99EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 fbe3b83332d7315864e0d684d1d10c428b07b058a92e0ab980a3d6e51295647a
MD5 49ea3b9d7963cc772d1c0bbf21125298
SHA1 22a9df4f28ac35a22f02d226ed76c59a2102fbf0
SHA512 faed875b1e93a2cd16f07c2d129bfa16112b30bb9ea94afafb054511940005acfaca2846ee2133aca7ff6b71ae7e25b3148d065f5e3b4ca947f3ab1657f8b833
SSDEEP 12288:CG6ky6T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rty6T7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T13BF41208539821D9E6B79234C67A82A4EF747C116F21A7CF46D0E23D2E3A7C07A75F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 5cc0212efeae5c1a6edbe955a7ea7edd59885850c8654511fdfdcb0dd4cf164c
MD5 1a4a7c48b48287ce49b61d21195cee29
SHA1 0a70aec043c613d99dc36636b64a51957b7f52e2
SHA512 7a1db907d950ad201ff8f56314ba92d0f367fd72c633ba5cec0827567c059665ad966c7d77256b9a30da1f353f30a965683088a8aa2e91ab26cff50fc344f7ed
SSDEEP 12288:mmWT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:HWT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T120D4234C9219269BD253E231823DD7D4F6B43A623F167ACB46D4A2B0861D3C0777BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 55b79f5399fd195b25cabb2422d900e3299601611fcc16ce724e1ae1326d4920
MD5 37e56a86c483c4e4979bc16def4cf875
SHA1 7e97b46af40098605049cd13ed4fdfc6c5c4f847
SHA512 0ded70d47c0e22a80db3181d7d8c1705aaa05e42f82e2e0ab1054fe26cf77b995516c16251c46abcd350c2b6f164d49ece0d46cfb799851751d26755f4f9c7f1
SSDEEP 24576:pCgN5oTfaidZPT7Jckdwi6i9bNrqq4E41WFpW3oRos:wgETrZL7Jckdwi3N7+WTW3
TLSH
T1FA559D1DA3EA05CAE2B2D235D9725493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-0-0x0000000002460000-0x0000000002575000-memory.dmp

Download

memory/520-7-0x0000000002680000-0x00000000026E9000-memory.dmp

Download

memory/520-6-0x0000000002680000-0x00000000026E9000-memory.dmp

Download

memory/520-1-0x0000000002680000-0x00000000026E9000-memory.dmp

Download

memory/1028-251-0x0000014E49BB0000-0x0000014E49C16000-memory.dmp

Download

memory/1028-250-0x00007FF7D7BE0000-0x00007FF7D7CF9000-memory.dmp

Download

memory/1028-337-0x00007FF7D7BE0000-0x00007FF7D7CF9000-memory.dmp

Download

memory/1028-252-0x0000014E49BB0000-0x0000014E49C16000-memory.dmp

Download

memory/1276-243-0x00000282439A0000-0x0000028243A06000-memory.dmp

Download

memory/1276-328-0x00007FF64FD30000-0x00007FF64FDF8000-memory.dmp

Download

memory/1276-242-0x00007FF64FD30000-0x00007FF64FDF8000-memory.dmp

Download

memory/1276-244-0x00000282439A0000-0x0000028243A06000-memory.dmp

Download

memory/1376-59-0x000001CF8E260000-0x000001CF8E2C6000-memory.dmp

Download

memory/1376-57-0x000001CF8DFF0000-0x000001CF8E0EB000-memory.dmp

Download

memory/1376-58-0x000001CF8E260000-0x000001CF8E2C6000-memory.dmp

Download

memory/1412-15-0x000002B9BD140000-0x000002B9BD1A6000-memory.dmp

Download

memory/1412-44-0x00007FF6E2F90000-0x00007FF6E30B2000-memory.dmp

Download

memory/1412-16-0x000002B9BD140000-0x000002B9BD1A6000-memory.dmp

Download

memory/1412-19-0x00007FF6E2F90000-0x00007FF6E30B2000-memory.dmp

Download

memory/1508-54-0x00007FF7925E0000-0x00007FF792747000-memory.dmp

Download

memory/1508-46-0x000001338CC40000-0x000001338CCA6000-memory.dmp

Download

memory/1508-47-0x000001338CC40000-0x000001338CCA6000-memory.dmp

Download

memory/1508-45-0x00007FF7925E0000-0x00007FF792747000-memory.dmp

Download

memory/1508-52-0x000001338CC40000-0x000001338CCA6000-memory.dmp

Download

memory/1924-272-0x00000000008C0000-0x0000000000929000-memory.dmp

Download

memory/1924-271-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1924-277-0x00000000008C0000-0x0000000000929000-memory.dmp

Download

memory/2052-296-0x00007FF615490000-0x00007FF615BD3000-memory.dmp

Download

memory/2052-283-0x00000290B0EB0000-0x00000290B0F16000-memory.dmp

Download

memory/2052-284-0x00000290B0EB0000-0x00000290B0F16000-memory.dmp

Download

memory/2700-305-0x00007FF6E3730000-0x00007FF6E3B46000-memory.dmp

Download

memory/2700-301-0x0000015A8D0C0000-0x0000015A8D126000-memory.dmp

Download

memory/2700-300-0x0000015A8D0C0000-0x0000015A8D126000-memory.dmp

Download

memory/3716-330-0x000001B4E5D50000-0x000001B4E5DB6000-memory.dmp

Download

memory/3716-331-0x000001B4E5D50000-0x000001B4E5DB6000-memory.dmp

Download

memory/3716-329-0x00007FF7B15D0000-0x00007FF7B1764000-memory.dmp

Download

memory/4336-36-0x000002B410000000-0x000002B4100FB000-memory.dmp

Download

memory/4336-37-0x000002B410220000-0x000002B410286000-memory.dmp

Download

memory/4336-38-0x000002B410220000-0x000002B410286000-memory.dmp

Download

memory/4376-29-0x00000167BBC90000-0x00000167BBCF6000-memory.dmp

Download

memory/4376-30-0x00000167BBC90000-0x00000167BBCF6000-memory.dmp

Download

memory/4376-27-0x00000167BBA20000-0x00000167BBB1B000-memory.dmp

Download

memory/4376-28-0x00000167BBC90000-0x00000167BBCF6000-memory.dmp

Download

memory/4828-264-0x00000282959F0000-0x0000028295A56000-memory.dmp

Download

memory/4828-349-0x00007FF7F0930000-0x00007FF7F0A79000-memory.dmp

Download

memory/4828-265-0x00000282959F0000-0x0000028295A56000-memory.dmp

Download

memory/4828-262-0x00007FF7F0930000-0x00007FF7F0A79000-memory.dmp

Download

memory/5140-297-0x00007FF7616A0000-0x00007FF76174D000-memory.dmp

Download

memory/5140-290-0x000001AED44F0000-0x000001AED4556000-memory.dmp

Download

memory/5140-291-0x000001AED44F0000-0x000001AED4556000-memory.dmp

Download

memory/5276-355-0x00007FF6B1B00000-0x00007FF6B1D8A000-memory.dmp

Download

memory/5276-350-0x0000023F75CD0000-0x0000023F75D36000-memory.dmp

Download

memory/5276-351-0x0000023F75CD0000-0x0000023F75D36000-memory.dmp

Download

memory/5316-311-0x000001AD9C9A0000-0x000001AD9CA06000-memory.dmp

Download

memory/5316-310-0x00007FF6675F0000-0x00007FF6676A3000-memory.dmp

Download

memory/5316-312-0x000001AD9C9A0000-0x000001AD9CA06000-memory.dmp

Download

memory/5744-320-0x00007FF7D2890000-0x00007FF7D2B32000-memory.dmp

Download

memory/5744-321-0x000001847EA50000-0x000001847EAB6000-memory.dmp

Download

memory/5744-322-0x000001847EA50000-0x000001847EAB6000-memory.dmp

Download

memory/5860-346-0x00007FF6FC430000-0x00007FF6FC750000-memory.dmp

Download

memory/5860-340-0x0000024D5CDF0000-0x0000024D5CE56000-memory.dmp

Download

memory/5860-344-0x0000024D5CDF0000-0x0000024D5CE56000-memory.dmp

Download

memory/5860-339-0x0000024D5CDF0000-0x0000024D5CE56000-memory.dmp

Download

memory/5860-338-0x00007FF6FC430000-0x00007FF6FC750000-memory.dmp

Download

memory/6092-233-0x00007FF64FD30000-0x00007FF64FDF8000-memory.dmp

Download

memory/6092-235-0x000002B9C1070000-0x000002B9C10D6000-memory.dmp

Download

memory/6092-234-0x000002B9C1070000-0x000002B9C10D6000-memory.dmp

Download

memory/6092-319-0x00007FF64FD30000-0x00007FF64FDF8000-memory.dmp

Download