Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 03:16
General
- Target 2026-08-08_81efa656b5d4e1310b09a45c36378845_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe
- Size 2.4MB
- Sample260808-dskqhsbd82
- SHA256 e2dc4b3b67c780c22de58a0678aada2d45d8666b45874e9f274623102e1af255
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 35 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_81efa656b5d4e1310b09a45c36378845_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_81efa656b5d4e1310b09a45c36378845_amadey_avoslocker_elex_luca-stealer_lynx_njrat.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
elevation_service.exe
wmpnetwk.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
AppVClient.exe
SgrmBroker.exe
msiexec.exe
memory/572-47-0x00000194CE030000-0x00000194CE150000-memory.dmp
memory/572-48-0x00000194CDB10000-0x00000194CDB76000-memory.dmp
memory/572-49-0x00000194CDB10000-0x00000194CDB76000-memory.dmp
memory/680-89-0x000001F976130000-0x000001F976250000-memory.dmp
memory/680-91-0x000001F9763A0000-0x000001F976406000-memory.dmp
memory/680-90-0x000001F9763A0000-0x000001F976406000-memory.dmp
memory/928-162-0x0000022289610000-0x0000022289676000-memory.dmp
memory/928-160-0x0000022289610000-0x0000022289676000-memory.dmp
memory/928-206-0x00007FF7506B0000-0x00007FF75083F000-memory.dmp
memory/928-161-0x00007FF7506B0000-0x00007FF75083F000-memory.dmp
memory/1924-64-0x0000016DE4880000-0x0000016DE48E6000-memory.dmp
memory/1924-65-0x00007FF674450000-0x00007FF6745B8000-memory.dmp
memory/1924-66-0x0000016DE4880000-0x0000016DE48E6000-memory.dmp
memory/1924-73-0x00007FF674450000-0x00007FF6745B8000-memory.dmp
memory/1924-71-0x0000016DE4880000-0x0000016DE48E6000-memory.dmp
memory/2384-266-0x00007FF7476B0000-0x00007FF747BDB000-memory.dmp
memory/2384-200-0x000002CC72280000-0x000002CC722E6000-memory.dmp
memory/2384-205-0x00007FF7476B0000-0x00007FF747BDB000-memory.dmp
memory/2384-201-0x000002CC72280000-0x000002CC722E6000-memory.dmp
memory/2412-262-0x00007FF6210E0000-0x00007FF6215BD000-memory.dmp
memory/2412-187-0x0000029220540000-0x00000292205A6000-memory.dmp
memory/2412-188-0x00007FF6210E0000-0x00007FF6215BD000-memory.dmp
memory/2412-189-0x0000029220540000-0x00000292205A6000-memory.dmp
memory/2492-134-0x00007FF75FB90000-0x00007FF75FC3B000-memory.dmp
memory/2492-136-0x0000020BC8A00000-0x0000020BC8A66000-memory.dmp
memory/2492-186-0x00007FF75FB90000-0x00007FF75FC3B000-memory.dmp
memory/2492-135-0x0000020BC8A00000-0x0000020BC8A66000-memory.dmp
memory/2756-15-0x00007FF7FA2E0000-0x00007FF7FA3C7000-memory.dmp
memory/2756-63-0x00007FF7FA2E0000-0x00007FF7FA3C7000-memory.dmp
memory/2756-17-0x0000022AAF7B0000-0x0000022AAF816000-memory.dmp
memory/2756-18-0x0000022AAF7B0000-0x0000022AAF816000-memory.dmp
memory/2756-16-0x0000022AAF7B0000-0x0000022AAF816000-memory.dmp
memory/3152-38-0x00000186A7E60000-0x00000186A7EC6000-memory.dmp
memory/3152-37-0x00000186A7E60000-0x00000186A7EC6000-memory.dmp
memory/3152-42-0x00000186A7E60000-0x00000186A7EC6000-memory.dmp
memory/3152-44-0x00007FF66EFA0000-0x00007FF66F228000-memory.dmp
memory/3152-36-0x00007FF66EFA0000-0x00007FF66F228000-memory.dmp
memory/3480-304-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-307-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-303-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-299-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-298-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-301-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-302-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-305-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-306-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-297-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-300-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3480-308-0x000001F0772B0000-0x000001F0772C0000-memory.dmp
memory/3572-98-0x000001FF1EBC0000-0x000001FF1EC26000-memory.dmp
memory/3572-99-0x000001FF1EBC0000-0x000001FF1EC26000-memory.dmp
memory/3572-97-0x00007FF7C79C0000-0x00007FF7C7AAA000-memory.dmp
memory/3572-166-0x00007FF7C79C0000-0x00007FF7C7AAA000-memory.dmp
memory/3804-0-0x0000000002830000-0x0000000002935000-memory.dmp
memory/3804-7-0x0000000000DF0000-0x0000000000E59000-memory.dmp
memory/3804-1-0x0000000000DF0000-0x0000000000E59000-memory.dmp
memory/3900-182-0x00007FF66F810000-0x00007FF66FACE000-memory.dmp
memory/3900-218-0x00007FF66F810000-0x00007FF66FACE000-memory.dmp
memory/4160-126-0x000001C895F90000-0x000001C895FF6000-memory.dmp
memory/4160-193-0x000001C895F90000-0x000001C895FF6000-memory.dmp
memory/4160-183-0x00007FF722790000-0x00007FF722BFD000-memory.dmp
memory/4160-195-0x00007FF722790000-0x00007FF722BFD000-memory.dmp
memory/4160-127-0x000001C895F90000-0x000001C895FF6000-memory.dmp
memory/4160-125-0x00007FF722790000-0x00007FF722BFD000-memory.dmp
memory/4340-119-0x00007FF6FE910000-0x00007FF6FE9B8000-memory.dmp
memory/4340-179-0x00007FF6FE910000-0x00007FF6FE9B8000-memory.dmp
memory/4340-118-0x000002266D970000-0x000002266D9D6000-memory.dmp
memory/4340-117-0x000002266D970000-0x000002266D9D6000-memory.dmp
memory/4388-142-0x00007FF61C320000-0x00007FF61C644000-memory.dmp
memory/4388-143-0x000001A5C2760000-0x000001A5C27C6000-memory.dmp
memory/4388-144-0x000001A5C2760000-0x000001A5C27C6000-memory.dmp
memory/4388-196-0x00007FF61C320000-0x00007FF61C644000-memory.dmp
memory/4400-105-0x0000000000760000-0x00000000007C9000-memory.dmp
memory/4400-110-0x0000000000760000-0x00000000007C9000-memory.dmp
memory/4400-112-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4400-169-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4440-79-0x00000199EEF90000-0x00000199EEFF6000-memory.dmp
memory/4440-159-0x00007FF6DD060000-0x00007FF6DD174000-memory.dmp
memory/4440-77-0x00007FF6DD060000-0x00007FF6DD174000-memory.dmp
memory/4440-78-0x00000199EEF90000-0x00000199EEFF6000-memory.dmp
memory/4532-170-0x0000016DEAFB0000-0x0000016DEB016000-memory.dmp
memory/4532-178-0x00007FF763CF0000-0x00007FF764119000-memory.dmp
memory/4532-172-0x00007FF763CF0000-0x00007FF764119000-memory.dmp
memory/4532-171-0x0000016DEAFB0000-0x0000016DEB016000-memory.dmp
memory/4532-176-0x0000016DEAFB0000-0x0000016DEB016000-memory.dmp
memory/4564-151-0x00007FF6A6250000-0x00007FF6A643F000-memory.dmp
memory/4564-152-0x000001CAFF440000-0x000001CAFF4A6000-memory.dmp
memory/4564-153-0x000001CAFF440000-0x000001CAFF4A6000-memory.dmp
memory/4564-199-0x00007FF6A6250000-0x00007FF6A643F000-memory.dmp
memory/4848-76-0x00007FF64B210000-0x00007FF64B2F4000-memory.dmp
memory/4848-29-0x00007FF64B210000-0x00007FF64B2F4000-memory.dmp
memory/4848-30-0x000001CE02080000-0x000001CE020E6000-memory.dmp
memory/4848-27-0x000001CE02080000-0x000001CE020E6000-memory.dmp
memory/4924-269-0x00007FF645540000-0x00007FF64567B000-memory.dmp
memory/4924-210-0x000001E038FE0000-0x000001E039046000-memory.dmp
memory/4924-209-0x000001E038FE0000-0x000001E039046000-memory.dmp
memory/4924-211-0x00007FF645540000-0x00007FF64567B000-memory.dmp
memory/4928-57-0x0000027B50E60000-0x0000027B50EC6000-memory.dmp
memory/4928-56-0x0000027B50E60000-0x0000027B50EC6000-memory.dmp
memory/4928-55-0x0000027B50C20000-0x0000027B50D40000-memory.dmp
memory/5012-224-0x00007FF660620000-0x00007FF660974000-memory.dmp
memory/5012-225-0x000001B809330000-0x000001B809340000-memory.dmp
memory/5012-241-0x000001B809560000-0x000001B809570000-memory.dmp
memory/5012-219-0x000001B8083F0000-0x000001B808456000-memory.dmp
memory/5012-220-0x000001B8083F0000-0x000001B808456000-memory.dmp
memory/5012-270-0x00007FF660620000-0x00007FF660974000-memory.dmp
memory/5012-257-0x000001B811920000-0x000001B811928000-memory.dmp