Overview

overview

10

Static

static

3

2026-08-28...er.exe

windows10-2004-x64

10

2026-08-28...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/08/2026, 02:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-28_5241d7903be0191f5c0add365f07b2d0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
  • Size 413KB
  • Sample260830-c28chaxgld
  • SHA256 47e3cfa62a64adebfe9b56cf92f6429219bc3d86045219f9f95435b1a498bcab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordiscoveryexpiro

Malware Config

Signatures

  • Family: Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 5 IoCs
    backdoor
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 10 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 58 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 30 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_5241d7903be0191f5c0add365f07b2d0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-28_5241d7903be0191f5c0add365f07b2d0_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:1004
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4720
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:1680
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:3248
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    PID:2344
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Windows\system32\compattelrunner.exe
      C:\Windows\system32\compattelrunner.exe -cv:kX9ykrB0lEGB6w/K.0.1 -wce:000000000000020C -fullsync -m:aeinv.dll -f:UpdateSoftwareInventoryW invsvc
      2⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3788
    • C:\Windows\system32\compattelrunner.exe
      C:\Windows\system32\compattelrunner.exe -cv:kX9ykrB0lEGB6w/K.0.2 -wce:000000000000020C -fullsync -m:devinv.dll -f:CreateDeviceInventory
      2⤵
      • Checks BIOS information in registry
      • Checks SCSI registry key(s)
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5332
    • C:\Windows\system32\compattelrunner.exe
      C:\Windows\system32\compattelrunner.exe -cv:kX9ykrB0lEGB6w/K.0.3 -wce:000000000000020C -fullsync -m:aeinv.dll -f:GetApplicationKBs
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2424
    • C:\Windows\system32\compattelrunner.exe
      C:\Windows\system32\compattelrunner.exe -cv:kX9ykrB0lEGB6w/K.0.4 -wce:000000000000020C -fullsync -m:appraiser.dll -f:UpdateAvStatus
      2⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2116
    • C:\Windows\system32\compattelrunner.exe
      C:\Windows\system32\compattelrunner.exe -cv:kX9ykrB0lEGB6w/K.0.5 -wce:000000000000020C -fullsync -m:GeneralTel.dll -f:RunGeneralTelemetry
      2⤵
      • Enumerates connected drives
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:5924
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:4388
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:5388
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:4972
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:4736
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    PID:5628
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    PID:2868

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.4MB
        • SHA256 30a64cdc23fab3704f8a5d096421160a27202e7a57d9e4866f734c54422d54c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 510KB
        • SHA256 c8339fccf6927dfe1590add433e6a36fc2b24454b4d1aa67fa160e9f9394bffe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 489KB
        • SHA256 f998023924c7a8dcd5ab7d899b4e076c873a75d0389c55dd2df4d7322a1cc6e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.5MB
        • SHA256 510121e0329aeb955242ddbf8a2961e1dc9c273b805e51c089a772d8a2f02c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.1MB
        • SHA256 d4cab7e15c05867a3e68bf6355a94904940d31f27d82988aa719cdf806a82f67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 796KB
        • SHA256 c43bb3b9bf27b9c048d06e0a76161d320ef4cb46c8e907286d61f5d823d3eec7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 420KB
        • SHA256 e2b41192084a871d29e07c61206bbc0bc41cb46d67d248589924666add8db6bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 428KB
        • SHA256 e788ef2c86adc69c2bc683b3d8160bd0e0bc5c40f2939f6008422b60835159f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 292KB
        • SHA256 1d03c3bbcdda0bc2a476fc20cd5df99a31506766f6fcf705efaeaf43d229f75a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 1.7MB
        • SHA256 50e9d05505c149777c0e6647777a9466291f5ac2b041a013bb9d799b9b01e061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1262955495.pri
        • Path C:\Windows\rescache\_merged\2118023660\1262955495.pri
        • Size 2KB
        • SHA256 f6f4c6ac3750138ba90518a8a910306bedf35abd47486100241027fde3a7ba8e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        3288486290.pri
        • Path C:\Windows\rescache\_merged\3906713228\3288486290.pri
        • Size 167KB
        • SHA256 d2f3b8a7d9442d711bcfa1cf25c4b038ab8be2d01ba4c6e0fa34ff09147bc7b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        4232904637.pri
        • Path C:\Windows\rescache\_merged\4136552255\4232904637.pri
        • Size 6KB
        • SHA256 eb5e6e1d8a29cf99d4bd6808776e0b84e7104a521812a38cb927b174b0bb6ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        670207856.pri
        • Path C:\Windows\rescache\_merged\4264460956\670207856.pri
        • Size 4KB
        • SHA256 b6c16b22cef5df81b77a9b16ee5cf51930362e3546c431574e313fa2497bb14d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1004-4-0x0000000000E80000-0x0000000000F53000-memory.dmp
        Download

        memory/1004-0-0x0000000000EEB000-0x0000000000F53000-memory.dmp
        Download

        memory/1004-3-0x0000000000E80000-0x0000000000F53000-memory.dmp
        Download

        memory/1004-2-0x0000000000EEB000-0x0000000000F53000-memory.dmp
        Download

        memory/1004-1-0x0000000000E80000-0x0000000000F53000-memory.dmp
        Download