Overview

overview

8

Static

static

3

2026-08-27...er.exe

windows10-2004-x64

8

2026-08-27...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/08/2026, 22:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-27_13ab901bbe11984dae4057ba7a4d3f48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
  • Size 557KB
  • Sample260827-2gr78a1eme
  • SHA256 3244ea30c0af75f9eecf089029d2a25efc02dfc62a7a8ab97f4bbf5f798ea604
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_13ab901bbe11984dae4057ba7a4d3f48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_13ab901bbe11984dae4057ba7a4d3f48_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2868
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:3432
  • C:\Windows\System32\GameInputSvc.exe
    C:\Windows\System32\GameInputSvc.exe
    1⤵
    • Executes dropped EXE
    PID:3200
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1712
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:680
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2960
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    PID:4872
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:2264
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:3920
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:5516
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:4728
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    PID:2740
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:4172
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    PID:2516
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:4552
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:5520
  • C:\Windows\system32\TieringEngineService.exe
    C:\Windows\system32\TieringEngineService.exe
    1⤵
    • Executes dropped EXE
    PID:1452
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    PID:2436
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:3676
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    PID:3992
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    PID:4340
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:3964
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    PID:1352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.6MB
        • SHA256 e65e5ca0edc62c7c772e2e842bbf86742e9b23e0f13b79964dd2f4d0373e5283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 658KB
        • SHA256 9a47e41777952b488eec1f08f9617955d56d2541d14f4fdfcebcb4d9c8f90e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 637KB
        • SHA256 2c153da14e0b49bb0be97158021a2436b7bc69f02d1bcd5b2fbd3ce89274dea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.6MB
        • SHA256 09542ae89f65a8ea14d76d46c8f2e2d4984cb0f9ed4035defa7a744a3c414188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 416KB
        • SHA256 1fa1a20801d4179049f8335fdf83030630513b91078577014102ee4372288fb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.2MB
        • SHA256 85d85935be3b37b12f03a607be90fdd7ab650064e5b034b8ac27459aa2762ffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 464KB
        • SHA256 1800a5e0a73f61562aaf80d20472a668196aed96f27fc2c191cc0cfce9c42944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 428KB
        • SHA256 6bcb695fa73cd6608d3864851f75d6b681bb79d5b792fcf1c50d1148b40ad295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 944KB
        • SHA256 8a985d737e70d4827f34a38ae6c1c7281d0aea2687022b8c7d752bda44361fee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 632KB
        • SHA256 2b9ad4534e0b49b2b13292bdfa6622e4c021e809d5f989c5ea40b67ff0cbc23a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.5MB
        • SHA256 3fda7aa89edada2383b1209b3e1751193efe5077e397e98e889728a610948a5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.3MB
        • SHA256 ff3a08eb59a7e2cfd7f1d7bc9eff5038563f6b0493381079ebf424e0a0841a33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.5MB
        • SHA256 6c55b9d7efcb7a526d79139efbb2ef7dd5f43cf360609b7ec207de9bdc40c7ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 736KB
        • SHA256 27e14bfc66c7b91f8ae1fef3937ba7da1c5490d131870a01b5d328bac0f15235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 1.8MB
        • SHA256 d115a121be23cf516ec30a3d177e1c3d08ce0163d591cfe67f78548cb8db2cc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 580KB
        • SHA256 68df35e9820c210ab5bbbf3f28e99b2697f56e554d75619fd443bf0b113f3d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 564KB
        • SHA256 9f107b00f5171cd640c01a3d2a0f7cec753ca59786ff98cb698ad3aab4ab2472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 572KB
        • SHA256 028673e1234e8b4d2c98cec43e8b9a6f6afd3f4690841aa3c8bdcc1cf82c50b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 436KB
        • SHA256 46c48cb2070fd4d70ae78bc1fd112687134cf4838faada49c5939b1c80fb72f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.0MB
        • SHA256 ed75951dfcde38b5a8668d93c1e66beba7404c11243cad1e78e1ec360985971f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 596KB
        • SHA256 b22814ead66c110550b5590d1acbdb12c2374b6ff5aa377b0cb9b252d6c407b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 1.9MB
        • SHA256 a20d68f429e68ccb158c90f00a8bb6d23043c19805e025c88a53bd85f30c2ed1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2868-0-0x000000000027F000-0x0000000000313000-memory.dmp
        Download

        memory/2868-2-0x000000000027F000-0x0000000000313000-memory.dmp
        Download

        memory/2868-4-0x00000000001F0000-0x0000000000313000-memory.dmp
        Download

        memory/2868-1-0x00000000001F0000-0x0000000000313000-memory.dmp
        Download

        memory/2868-5-0x00000000001F0000-0x0000000000313000-memory.dmp
        Download

        memory/4728-93-0x0000000000400000-0x00000000004FF000-memory.dmp
        Download