Overview

overview

8

Static

static

3

2026-08-27...er.exe

windows10-2004-x64

8

2026-08-27...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/08/2026, 22:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-27_13ab901bbe11984dae4057ba7a4d3f48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
  • Size 557KB
  • Sample260827-2gr78a1eme
  • SHA256 3244ea30c0af75f9eecf089029d2a25efc02dfc62a7a8ab97f4bbf5f798ea604
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Disables taskbar notifications via registry modification
    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_13ab901bbe11984dae4057ba7a4d3f48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_13ab901bbe11984dae4057ba7a4d3f48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3036
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Windows security modification
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:2204
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:860
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3940
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3116
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:772
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4168

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.6MB
          • SHA256 f0c20250a3963b235d9e79324ba3f7245a17b0502954e6e6216ca1cd53eb081c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7z.exe
          • Path C:\Program Files\7-Zip\7z.exe
          • Size 945KB
          • SHA256 cb3745c4b2feebde1c159a1c8486067300e62667722dfbf34e991634747a77ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zFM.exe
          • Path C:\Program Files\7-Zip\7zFM.exe
          • Size 1.3MB
          • SHA256 250948487c1eeb51311d282d600f78a466a7bbbe6bdccef74ee3f55548fc30f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          7zG.exe
          • Path C:\Program Files\7-Zip\7zG.exe
          • Size 1.1MB
          • SHA256 2c708d3aa40bcda7ec4924bd3cd7ab37b663aa6b64186a65fe3d5a16203f477d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Uninstall.exe
          • Path C:\Program Files\7-Zip\Uninstall.exe
          • Size 410KB
          • SHA256 0951ca202653ba3b6e6ee7ffed3f53890c54546768446acd93c6e480f3c10fa1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVShNotify.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
          • Size 672KB
          • SHA256 e8ae20f95559b591bb6efea7f896d255b92124f2a7ac2e1e9c49fed0ea4a7d6b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          IntegratedOffice.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
          • Size 4.5MB
          • SHA256 c691d439f92eb7009963afa9aa87648518bb55d1f943f30c201cb13e1f005ddf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MavInject32.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
          • Size 738KB
          • SHA256 7e145fe49f1c756addae809c5327e60e4c35f515a17b4cdf1cf871f16bc864a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OfficeC2RClient.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
          • Size 23.8MB
          • SHA256 1b6886f27e4e498a1b3a18fde110717b8dfb932b6f2d075f61afd3ad7b70aae5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          appvcleaner.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
          • Size 2.5MB
          • SHA256 aa8215c0c80674a2ff6539ee27847d69de388cc2536e8003506a899e5b0a467d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 2.6MB
          • SHA256 e2a0d3b2cb0f1759f6827000a43bde1e9774ac7b58d6c296661b00d20fb987b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qfhhhdbp.tmp
          • Path C:\Users\Admin\AppData\Local\befbkjii\qfhhhdbp.tmp
          • Size 625KB
          • SHA256 d3f8e4c4d3e201989cb187a3c2e9bace88068df5dc56252698e78e301fb14a13
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          powershell.exe
          • Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          • Size 818KB
          • SHA256 241d8a7d162a8c01ef010162a1668d40e312deed64fd4956d6cd209ba3227731
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DiagnosticsHub.StandardCollector.Service.exe
          • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
          • Size 487KB
          • SHA256 6a3bcfe2c8f224e95a704e546c6bfcac55afc1b1a7c81dd8e26a740aa22e81f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FXSSVC.exe
          • Path C:\Windows\System32\FXSSVC.exe
          • Size 1.0MB
          • SHA256 0b2f7f727ae713278d9d301c233f9a6304ef02e353b7a7b7f4f8c42e3b53c46d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          alg.exe
          • Path C:\Windows\System32\alg.exe
          • Size 489KB
          • SHA256 bc0989555a48c6ac9f056632246079848a1732ebb50bfce311c641e98ddf7f4a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.exe
          • Path \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
          • Size 658KB
          • SHA256 0c2cdb4021af0c5a49c062599bc5e7b3329ab19b3d43d5a41f163d4165d9302c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ose.exe
          • Path \??\c:\program files\common files\microsoft shared\source engine\ose.exe
          • Size 637KB
          • SHA256 07e51b5aa5b7d8212df7c7e7c93432de071c7441fa1fbc8d4c3255e1166d0119
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Appvclient.exe
          • Path \??\c:\windows\system32\Appvclient.exe
          • Size 1.1MB
          • SHA256 7a5912e62d159c542d44e9e7424cdb5671eb144d2d896b1e7167eab8e0f6f2a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          locator.exe
          • Path \??\c:\windows\system32\locator.exe
          • Size 406KB
          • SHA256 ff501c53590b255abf8ba73f3312615a7b5d3a265eb350dcd62dee8d7d270a42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msdtc.exe
          • Path \??\c:\windows\system32\msdtc.exe
          • Size 540KB
          • SHA256 67d6dc4335d119c98dc0b78a7ff30632e8310e5d70e86438ed0396f57d96ab63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msiexec.exe
          • Path \??\c:\windows\system32\msiexec.exe
          • Size 463KB
          • SHA256 e42a2a00f974c596440deae2f7e468c4e9f7a63210d6b58782462c958f8ffc2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path \??\c:\windows\system32\openssh\ssh-agent.exe
          • Size 772KB
          • SHA256 63932a35f63f29583fb26609345fe28cc302c8b4bd125a1169ded06e50dbd728
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perceptionsimulationservice.exe
          • Path \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe
          • Size 499KB
          • SHA256 fe2e41b5e01eccc1cf6bd42c53638003434398695e8082e13631ff72f3d86a73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sensordataservice.exe
          • Path \??\c:\windows\system32\sensordataservice.exe
          • Size 1.6MB
          • SHA256 8d3a11c0b3ae02be52569f3972f7e2cd333ffa6f4c955a6e5fdcb6f4455df494
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sgrmbroker.exe
          • Path \??\c:\windows\system32\sgrmbroker.exe
          • Size 705KB
          • SHA256 20c28977e9137e88ba02008a45f420e1ba9f6ac6ea409db3aa1b7ffbf31bb066
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snmptrap.exe
          • Path \??\c:\windows\system32\snmptrap.exe
          • Size 412KB
          • SHA256 c27aa8a4543cbcb2a095cca709d246c797fa0784db80f84f6a4e3dc6cf1ff981
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spectrum.exe
          • Path \??\c:\windows\system32\spectrum.exe
          • Size 1.2MB
          • SHA256 bb06a1b9e4b95403e44a4167a1e9783bf3a671f82f77910fe5e1b0347ab9b24c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perfhost.exe
          • Path \??\c:\windows\syswow64\perfhost.exe
          • Size 416KB
          • SHA256 c3e0f5c58887849fcc1486cf9053feb53a41f9f5c3bf8d078aeea9f147cdb777
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2204-50-0x0000000140000000-0x0000000140136000-memory.dmp
          Download

          memory/3036-0-0x0000000000FCF000-0x0000000001063000-memory.dmp
          Download

          memory/3036-5-0x0000000000F40000-0x0000000001063000-memory.dmp
          Download

          memory/3036-4-0x0000000000F40000-0x0000000001063000-memory.dmp
          Download

          memory/3036-2-0x0000000000FCF000-0x0000000001063000-memory.dmp
          Download

          memory/3036-1-0x0000000000F40000-0x0000000001063000-memory.dmp
          Download