Overview

overview

10

Static

static

3

2026-08-09...at.exe

windows10-2004-x64

10

2026-08-09...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 14:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_06fc49001eb45d8ee13ed1df6f286265_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
  • Size 722KB
  • Sample260809-scte2sgq5z
  • SHA256 44c4a107c427812112eb02f8a752cc2788f768a78953046ffa693e3a816a85e5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoorcredential_accessdefense_evasiondiscoveryexpirospywarestealertrojan

Malware Config

Signatures

  • Family: Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 1 IoCs
    backdoor
  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops Chrome extension 1 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_06fc49001eb45d8ee13ed1df6f286265_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_06fc49001eb45d8ee13ed1df6f286265_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat.exe"
    1⤵
    • Drops Chrome extension
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2328
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Windows security modification
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:3336
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3004
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:4416
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:4732
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:4352
  • C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\servicing\TrustedInstaller.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:3480

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.7MB
        • SHA256 f7077c525d9aa3757a4a9cbc5e970c984f5caecfeeab685d0f5f8a385dc1c5da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 818KB
        • SHA256 df600335b2f5e4075676fb8d55826f3c3292cbe5add568b923a4c10bd6c542f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 1.1MB
        • SHA256 83807a3921f6704d13a24b21b8fad23eac5c68cda1127f00760a63d19cd18326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.5MB
        • SHA256 bba75618ce7d053324b54b58714c55ca619f4d0840537de17ce62f4ac381cda4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.2MB
        • SHA256 14c02e10e5aaed2fe3f6e48a9f77ad0c58be45caf618b391ebabec110f278ba2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 832KB
        • SHA256 2998af1f59dd02cd9ac32ad543b7221e92289f0c4953dfc94df9777ab591c063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 4.6MB
        • SHA256 a14cf31810351a1f4b7fc7ddc8596101a80fdafe64724673c1fc9ff6ae02733a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 898KB
        • SHA256 230ad04bde1a666071cf1b725583e0b7b3d555ffb3117f6e610f4a4832f9085c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 24.0MB
        • SHA256 79a9fc4d72ce8352bb4d402a442cfe32cbcec449221db0b4a33929e7a9457a2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 2.7MB
        • SHA256 13d9ee22b39373806de4d712bc91652f430a67440f2042a9d84041cc3ed18f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 797KB
        • SHA256 412658b5cd2fe35b8858028a6b9c31a3b11ecbcf0f65133d4c08b4b0e8b1bc97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bhlnifll.tmp
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\bhlnifll.tmp
        • Size 6.6MB
        • SHA256 17bdf4568adeaed0596b48c890f0d1cbfcd3fe7485fb718f3defd58e9b3aae9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.8MB
        • SHA256 fdcac022bf8076df18a8df1b271646f98f3628eabe606dd493dbc50ebf2f71ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iexplore.exe
        • Path C:\Program Files\Internet Explorer\iexplore.exe
        • Size 1.3MB
        • SHA256 5ea2a820edc63202c1857a32a90a3f3323d42111f84584ba74e537816e468875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        powershell.exe
        • Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        • Size 978KB
        • SHA256 758f209e85acf5fc40e7f255aff761f7468c4615f88672a6721a86fc1c26ea74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 932KB
        • SHA256 46df1c7ed021f3a8f97da459636cb65c76bc0acee1c6646863ebafc027af503e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lkfmcaoo.tmp
        • Path C:\Windows\System32\lkfmcaoo.tmp
        • Size 1.3MB
        • SHA256 ce54135b9cf12bae17380b9bdaaa7fb68fe45e996901fa3b2981c6df0f07b447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TrustedInstaller.exe
        • Path C:\Windows\servicing\TrustedInstaller.exe
        • Size 193KB
        • SHA256 73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path \??\c:\program files\windows media player\wmpnetwk.exe
        • Size 1.5MB
        • SHA256 8987cba16f94c05f65d21a51f9732456ec32fc96dd944e2e246d294c4415b9a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Agentservice.exe
        • Path \??\c:\windows\system32\Agentservice.exe
        • Size 1.7MB
        • SHA256 875adb609e9b3d82df59b9f0eb14e5d656f651e896521697b9fff5b8b6fd3c0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fxssvc.exe
        • Path \??\c:\windows\system32\fxssvc.exe
        • Size 1.2MB
        • SHA256 15bad60b0b74400483952db879667dc9e192ee3d55b311780be6c5233f787d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path \??\c:\windows\system32\msdtc.exe
        • Size 700KB
        • SHA256 2ade5472d4740f0e4e7b309bd58c32d3ed3609739c586d4d2e5eb220228ea2cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path \??\c:\windows\system32\msiexec.exe
        • Size 623KB
        • SHA256 adca2d086853e808da3b3d4d5b4d42d496795ff62d2970b39cf23037fb227215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path \??\c:\windows\system32\snmptrap.exe
        • Size 572KB
        • SHA256 940b0c12b4608fec98bbbc3858cb050db5ee8063d03646d8df645adf14fe9ec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path \??\c:\windows\system32\wbengine.exe
        • Size 2.1MB
        • SHA256 9df435166df63947379428f0462219e31b08cec8d3524f62ab5ea705bbe17c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2328-15-0x0000000000400000-0x0000000000676000-memory.dmp
        Download

        memory/2328-0-0x0000000000400000-0x0000000000676000-memory.dmp
        Download

        memory/3004-22-0x0000000140000000-0x00000001404B7000-memory.dmp
        Download

        memory/3004-96-0x0000000140000000-0x00000001404B7000-memory.dmp
        Download

        memory/3336-93-0x0000000140000000-0x00000001404CD000-memory.dmp
        Download

        memory/3336-16-0x0000000140000000-0x00000001404CD000-memory.dmp
        Download

        memory/4352-59-0x0000000140000000-0x00000001402E6000-memory.dmp
        Download

        memory/4352-129-0x0000000140000000-0x00000001402E6000-memory.dmp
        Download

        memory/4416-42-0x0000000140000000-0x00000001402B9000-memory.dmp
        Download

        memory/4416-28-0x0000000140000000-0x00000001402B9000-memory.dmp
        Download

        memory/4732-48-0x0000000140000000-0x00000001402B3000-memory.dmp
        Download

        memory/4732-120-0x0000000140000000-0x00000001402B3000-memory.dmp
        Download