fab0be28a801679e5a0fee79d2de8f0b7e3dd93ede30422bcf080165d7ebd941

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
Size 873KB
Sample260820-nblllaar8s
SHA256 fab0be28a801679e5a0fee79d2de8f0b7e3dd93ede30422bcf080165d7ebd941
MD5 e05f44051ee4adc95a077d011a588f3f
SHA1 6012532df9ad0ffb9d7e184239ae2659498bb8ba
SHA512 4d40616a2bdd4a568374a33f2f87129002a726088d3f2930d41a0a5490f796c85a3558b70212f5790929d05215027ab2f5c81de9e405e7c4f3462bf757642866
SSDEEP 24576:Fv/Hb/xc7pK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:B/HbK1KOEFH8sy7RqmV1ye
TLSH
T13F15E02173E08072E2B71A319A7AC7624C7FBC765872898E73D8791D5D32BC1D538B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4964	alg.exe
5836	GameInputSvc.exe
3124	GameInputSvc.exe
2876	elevation_service.exe
544	elevation_service.exe
2840	maintenanceservice.exe
4048	msdtc.exe
4712	OSE.EXE
5512	PerceptionSimulationService.exe
3172	perfhost.exe
1876	ReFsDedupSvc.exe
3556	locator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92c2b069c618523d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3124	GameInputSvc.exe
3124	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2808	2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
Token: SeTcbPrivilege	5836	GameInputSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1876	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4964	alg.exe
Token: SeDebugPrivilege	4964	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 3124	5836	GameInputSvc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e05f44051ee4adc95a077d011a588f3f_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2840

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4048

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4712

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5512

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3172

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 174a75feac0e810cec87695cd541039afccd95385cedb037c3b2c59381c37cba
MD5 3ba9f3c578a1ae45e573ce390a95b94b
SHA1 cb842e197c7299ee5e6e43e28e8ac9639bca8442
SHA512 85f66efe5330360b3c98b786f4c2f089e2ecbb19b740597d642c8e2dbfe5649196d524144a93e98b61e49eba9400f58a54e1b7c570c17562cda941d96e252949
SSDEEP 49152:XKNm32BuPkFKRrdE6oh7stBhuXjfS4LWxnMKOEFH8sy7RqmV1ye:F3q6gjB1Eh8XRqmzy
TLSH
T19ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 1a7805f0f96cd8f107d1ebe086b99bf914b778c0bf29d9b2a1b629c3684caeee
MD5 233f1b330d66b497751680d49f7c87bc
SHA1 26b36865e83d50641ff65b18688cd1c03ec987f7
SHA512 c84be2ebb633e45a795bb4340c76ca3481802db5a1353e3e7b435445b2172ee9a7f0714301b6339fb15c51163761c61107c897634f4104a9ad41d2cc6ba8229d
SSDEEP 24576:HXY54vczAcK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:DvctKOEFH8sy7RqmV1ye
TLSH
T14905022973E409FADD67427CC9A2C502FA73B8554764EB9B03E495291F333881E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 810d18c64383e08b20626ec12f4cf65f5f10b2290656651ea8fe804c387c68f5
MD5 a320711f666fb9822ea61c373d826d7f
SHA1 ab6e4f58635d4b97787f7f1728702ed77665093a
SHA512 4ac9eb836772d88da9b375b0c9f8f617ce73a05bcbd2e9c3d08e5e95df2e0ae72987aea8af9ac0c2a3da868d2fec1ef792d89337300ce04093df42a2e4069230
SSDEEP 24576:Qwu+OWHK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:QwlOkKOEFH8sy7RqmV1ye
TLSH
T13505F14677A40CFAEAA742388597C532FBF2B8022A25CB1F1760C65B5F373516D2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 be4a83428d6e9c0a2d0dba9bd625a0091417f895ad06eac012a0d5a4fd8d8347
MD5 daf89c05adad7fa0b8f85aa8073b68a6
SHA1 f8e68bfe0ff0f1c70d1d9ba80a12e019d9503d07
SHA512 3f12813dc1e8d1fe8bae607a76ad9d0fa2d9c353138f7f9c3792fdd86208714677a663ba6203aae5caaa73ec6f9e618169cc81ea77512bff9bec301f752538f8
SSDEEP 49152:+D+taZ3usBWOBr4tEGp0bqx0z+n217aau1glPKOEFH8sy7RqmV1ye:Gu6JmTxd2dlEh8XRqmzy
TLSH
T168D59D13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 607KB
SHA256 6e00a2b6f2ecfd7f031bb44bcad0973001ec993ac766e8d2b36fe22178e54497
MD5 13c883e1d648fab9130b3a2f27c9a881
SHA1 851e09857b22ca34536c9f7216ab7184ac9daf82
SHA512 11e200918d545f7b144c28bb9c2024b1194cd74aaaddfec67bc1938b46a41df3d692696710fd91f08bb3f1050c3c71ccd26f56fb77b84e71f9781ac75a523979
SSDEEP 12288:IN7aK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:oaK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T11FD42306A72986D7D7BA13B4819BC1923C2CF8169F94CEDB7748B06D6CB02C525366B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 f6588be5b5d84191670de8bf611e543accf5529e25552e033ac45138436b1494
MD5 32a8bd500f577dae31e5f9eafd92889a
SHA1 e58f17394859848d8e5df7a4a558a388299f152a
SHA512 0f6b86da11f1f2de4edc2adaf81c99f0f0fecd9574faa1a316ca9ba548cc367cbad3e497ec504a384f93d12cf72f4b2c70cbbf1fe1a337fc01fdc86f1f3e1db3
SSDEEP 12288:PlGPK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:tGPK3zNf0lmRXrz8Upy7Rqm4UHMp2yum
TLSH
T1E5E4221E76B661DAC67A437984A7C4D37CB074515B249EFF26E8E03D8DA42D0323ADE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 2e7fd98fe6369081c49f882e87a3d001af70f06adcf2655d37d8f9badd7d4bf1
MD5 e51ba183ec5ec9281852857131aaec57
SHA1 ac7ae58bfe0d8655d5f11591e8e415e88e63a284
SHA512 b831c447ae94e2c93a121c7e6959a68e600d4748663ab69ecc900e19af33ae5ad13da6869f348d4d9df03802f3a61d414a2e15ddbcf997536162d23438acdb02
SSDEEP 12288:6zK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:6zK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T10AD4230AA62582DBC7BA17B581D7C5C33C68D4069B998FEB379CB02D5CB42C631366F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 22bcd6ac6484e947443b1df5dfe57176d634f9ce5ae291876ac79da3292a3eba
MD5 8109acfe70a3515374d6473d67921122
SHA1 cd65c630ed6f51a51fde879afa9b016beee31293
SHA512 0f7cecb698f6eb339be219eef9e78d85bad5e820244eea78c5f7c1e6b5aef7abd5ea227d4f1ee544d2c2cacb21589f8af30eda2c5c55f37cba6a2076711bf952
SSDEEP 24576:PPUr+NQqK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:PJQqKOEFH8sy7RqmV1ye
TLSH
T19005F11F62AD18E5E67AA17D85838749F771B4620712D6CF03E0817E4E63AD87D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 6ea323930b85021039349f165ea386dbde1e5ed64f67646e35e794754712134c
MD5 e5466628ded459574e49696f4117d368
SHA1 466471516f128cd3bcb37e5dcbf027771a5842ed
SHA512 7830a681471da02a3d18ee70c8df350d54554f2a5c02fb9055fa06b3a2da511f10a40029d73c79a09f4d0ac2f5224478383c59a1fcf9d5ff9a43f3e84c4ac2c3
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjKOEFH8sy7RqmV1ye:JG05lO43b0Eh8XRqmzy
TLSH
T1C4D5CF6A62EC11F9D1BBC17CDAC68A0BEBB23415033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 34e39115946d2a1936b8d0bbb90ccc1523eca6f11e94fbe00796202d10f940a1
MD5 6c7e95f986b7725ac7af13a825000a1a
SHA1 4eb66674b6024213f65eca57d8d145cda4425db8
SHA512 ae39c2fa090d406bf359e1af9cccc5417409f0c917f4501f2a497facd7fb7a0f3f8de8937adf4e1e82bc05132dee354a8d752e5ee8b49c239e7fbc9462733c2d
SSDEEP 24576:t/DIeK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:t/DIeKOEFH8sy7RqmV1ye
TLSH
T108F4011D337A10FAC1BB903EC6834542E5B2B07187625EDF1B98D07E5EA3EC87539A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 d340735fcb49c7ef7a3c245cfcfa5b5fd570bc0ccf8c166ebd870022d8950263
MD5 8c4c5bca6d03f73e03f3113c424b07e6
SHA1 f4ddcc59f82f8c6091e3fd6666b7f7c51933cc58
SHA512 76a04054d5ae2bb79316f5ba61134ef542a594cdadf264308ee903f517d2eff907edb4e60989e4bee9a58db3b227808583651e1c3bd7aff6d578666f88f0ed47
SSDEEP 12288:PG6kygK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:+tygK3zNf0lmRXrz8Upy7Rqm4UHMp2y5
TLSH
T1ADF4120563A461D6D7BA03788AA3C1D1AD34BC219B618BEF36D0F23E2E757C43535B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fbf8382977cc03ea93915cc220efa1ff1b2b64f514bf61133ac8408390fad89d
MD5 fd90d898d6cc23fee15e1f346c458940
SHA1 9165f2e6c676cc289e91c354f273e901ec3da2c1
SHA512 98546970c629282763dbb1fd5201ab313ad345680e9534fe2dea3e260479a0d60a1eb3f9929cf1eeb2417577d7f1c2b5a977399bfa13175362a642774ddbd6bb
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmZK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:wTMwBtOmZKOEFH8sy7RqmV1ye
TLSH
T18A55AF6EB6B846E4D1FEC6B5CD238512EA727461073293CB5390C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 e2cc1ece29f297e783c42292127cb077a55d3bea66cc6be486bdea205d11d85a
MD5 fe1709d6a73169ce680e6eeb4424e5a2
SHA1 c0ef0cdabc0d3dadca165b3f62a86816ec5a06fa
SHA512 97eacb10d6077c8689cca7d25b387cc68b33f3959eabfce1c2fede69a65397c819b61074314046cbca17c60e7e40dd014ce47be15bd288958b36b33e770478c4
SSDEEP 12288:oyb6b3IkxjbBzFK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tm:f6UqjpFK3zNf0lmRXrz8Upy7Rqm4UHM1
TLSH
T189F4120E639460EAD57A0274D5A7C16258B4BC3217B59EEF33D8A13E8E31AC4513FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-57-0x0000024E6CCD0000-0x0000024E6CD36000-memory.dmp

Download

memory/544-56-0x0000024E6CCD0000-0x0000024E6CD36000-memory.dmp

Download

memory/544-55-0x0000024E6CA20000-0x0000024E6CBA7000-memory.dmp

Download

memory/1876-119-0x00007FF6CC910000-0x00007FF6CD053000-memory.dmp

Download

memory/1876-120-0x00000194DE730000-0x00000194DE796000-memory.dmp

Download

memory/1876-118-0x00000194DE730000-0x00000194DE796000-memory.dmp

Download

memory/1876-148-0x00007FF6CC910000-0x00007FF6CD053000-memory.dmp

Download

memory/1876-153-0x00000194DE730000-0x00000194DE796000-memory.dmp

Download

memory/1876-154-0x00007FF6CC910000-0x00007FF6CD053000-memory.dmp

Download

memory/2808-39-0x0000000000550000-0x00000000007FB000-memory.dmp

Download

memory/2808-1-0x0000000002A00000-0x0000000002A69000-memory.dmp

Download

memory/2808-6-0x0000000002A00000-0x0000000002A69000-memory.dmp

Download

memory/2808-136-0x0000000000550000-0x00000000007FB000-memory.dmp

Download

memory/2808-23-0x0000000000643000-0x0000000000644000-memory.dmp

Download

memory/2808-0-0x0000000000550000-0x00000000007FB000-memory.dmp

Download

memory/2840-64-0x00007FF671190000-0x00007FF6712F7000-memory.dmp

Download

memory/2840-65-0x00000178185C0000-0x0000017818626000-memory.dmp

Download

memory/2840-66-0x00000178185C0000-0x0000017818626000-memory.dmp

Download

memory/2840-71-0x00000178185C0000-0x0000017818626000-memory.dmp

Download

memory/2840-73-0x00007FF671190000-0x00007FF6712F7000-memory.dmp

Download

memory/2876-47-0x0000018801740000-0x00000188017A6000-memory.dmp

Download

memory/2876-48-0x0000018801740000-0x00000188017A6000-memory.dmp

Download

memory/2876-46-0x00000188015B0000-0x0000018801737000-memory.dmp

Download

memory/3124-94-0x00007FF667900000-0x00007FF6679C8000-memory.dmp

Download

memory/3124-40-0x0000024059270000-0x00000240592D6000-memory.dmp

Download

memory/3124-36-0x00007FF667900000-0x00007FF6679C8000-memory.dmp

Download

memory/3124-37-0x0000024059270000-0x00000240592D6000-memory.dmp

Download

memory/3172-107-0x00000000008E0000-0x0000000000949000-memory.dmp

Download

memory/3172-106-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/3172-112-0x00000000008E0000-0x0000000000949000-memory.dmp

Download

memory/3172-146-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/3556-128-0x000001C965A10000-0x000001C965A76000-memory.dmp

Download

memory/3556-127-0x000001C965A10000-0x000001C965A76000-memory.dmp

Download

memory/3556-149-0x00007FF7387C0000-0x00007FF73886D000-memory.dmp

Download

memory/3556-126-0x00007FF7387C0000-0x00007FF73886D000-memory.dmp

Download

memory/4048-141-0x00007FF78E0E0000-0x00007FF78E1F9000-memory.dmp

Download

memory/4048-78-0x000001CA477D0000-0x000001CA47836000-memory.dmp

Download

memory/4048-77-0x000001CA477D0000-0x000001CA47836000-memory.dmp

Download

memory/4048-76-0x00007FF78E0E0000-0x00007FF78E1F9000-memory.dmp

Download

memory/4712-88-0x000001F8B3080000-0x000001F8B3207000-memory.dmp

Download

memory/4712-90-0x000001F8B3210000-0x000001F8B3276000-memory.dmp

Download

memory/4712-89-0x000001F8B3210000-0x000001F8B3276000-memory.dmp

Download

memory/4964-18-0x0000017E8BC10000-0x0000017E8BC76000-memory.dmp

Download

memory/4964-15-0x00007FF7F8840000-0x00007FF7F8962000-memory.dmp

Download

memory/4964-52-0x00007FF7F8840000-0x00007FF7F8962000-memory.dmp

Download

memory/4964-16-0x0000017E8BC10000-0x0000017E8BC76000-memory.dmp

Download

memory/4964-17-0x0000017E8BC10000-0x0000017E8BC76000-memory.dmp

Download

memory/5512-144-0x00007FF7E51B0000-0x00007FF7E52F9000-memory.dmp

Download

memory/5512-100-0x0000016393B50000-0x0000016393BB6000-memory.dmp

Download

memory/5512-99-0x0000016393B50000-0x0000016393BB6000-memory.dmp

Download

memory/5512-97-0x00007FF7E51B0000-0x00007FF7E52F9000-memory.dmp

Download

memory/5836-30-0x000001951BFC0000-0x000001951C026000-memory.dmp

Download

memory/5836-28-0x000001951BFC0000-0x000001951C026000-memory.dmp

Download

memory/5836-29-0x000001951BFC0000-0x000001951C026000-memory.dmp

Download

memory/5836-27-0x00007FF667900000-0x00007FF6679C8000-memory.dmp

Download

memory/5836-63-0x00007FF667900000-0x00007FF6679C8000-memory.dmp

Download