Overview

overview

10

Static

static

3

2026-09-07...ay.exe

windows10-2004-x64

10

2026-09-07...ay.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/09/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-07_e747210af1eefd2addb36386a0ee3894_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
  • Size 562KB
  • Sample260908-dfmdksyzdz
  • SHA256 3a80be5818e08368a3021fd680621879ef55d1f35903bb5756c53c011c2748ae
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexpiro

Malware Config

Signatures

  • Family: Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 6 IoCs
    backdoor
  • Executes dropped EXE 22 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_e747210af1eefd2addb36386a0ee3894_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_e747210af1eefd2addb36386a0ee3894_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:996
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:1464
  • C:\Windows\System32\GameInputSvc.exe
    C:\Windows\System32\GameInputSvc.exe
    1⤵
    • Executes dropped EXE
    PID:4872
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:612
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:252
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:2492
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    PID:5088
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:4612
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:3020
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:2892
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:2760
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    PID:4276
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:4576
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    PID:5896
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:5752
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:4184
  • C:\Windows\system32\TieringEngineService.exe
    C:\Windows\system32\TieringEngineService.exe
    1⤵
    • Executes dropped EXE
    PID:4688
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    PID:3604
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:5380
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    PID:5328
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    PID:4504
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:6068
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    PID:5448

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.6MB
        • SHA256 4ca3636e60e60f56c241749c2bbde6d774f66a380d1fb8c374e8607b8a7f2ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 658KB
        • SHA256 926dacc5719144117048d36bb86263840de6187dd1a888a57bdc9be09a0f3280
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 637KB
        • SHA256 59bd02e37215a9435e3d6c44518551e69871bd22bf9d101f3c70af93f100710d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.6MB
        • SHA256 54ccccb76b01e10b5cf31d81d6a38314a695eb622fc069c0637f9d1c2cd05edd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 420KB
        • SHA256 591b38ee9ead5ccaef01bef577d3f3d2b3308f180be918fd4fc9b862d27c9dcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.2MB
        • SHA256 6f85bb9a7916eaf11c9e80540897e200b0b1556c5edcac70ee14502bcaa2c70d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 468KB
        • SHA256 577d174fd0128b83e29811f5751cb9a523513613d1972b2a6d240e728fa45760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 432KB
        • SHA256 92a8d95d8798dc7d10e2db349fbd08c32b1c1c9b38c9b40b60fd7dbcbfb79762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 944KB
        • SHA256 01173e78da4cc55557b0ced466682c1f2bd42bb8e8923d93c2de930dad53d9e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 636KB
        • SHA256 28f8c11e227ce1f964a4a1f1ef4e60f6aec71e1389c631ae87f21c51e4f83561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.5MB
        • SHA256 f1a6c2ddbc2874c0f7191d25ec406aecfe88c2ea610064dbf1b1c464a8fc3d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.3MB
        • SHA256 39ad7aaa07f5a4ac5c7ce43d465b2cc0ec1d2f4f730c738867b4abf1c74100a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.5MB
        • SHA256 8df4ae62651358d95fa1e45c9bbe475c41d34041128da308cebb8a430ce53545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 740KB
        • SHA256 8ff22f39b2dcf54e5c390e6bc5bee538a042650e5a1f4f17b03bfee277720789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 1.8MB
        • SHA256 bc79469be168971c2a4977aac4b6f5f511f8ee2d6765ff7437d6bd0052992378
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 584KB
        • SHA256 ac58394ef4f087d37d3758cc74e96efb27a92989e15dbb5483e8bb7ffa46099f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 568KB
        • SHA256 8c3c4305eabbd3e51d082ffd8e9f5c75c94efe04d8e0e1d65f7de37f0e8869e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 576KB
        • SHA256 deb249483d0d665fbe5aa8d34666da92dbc9fcb14768c6b2e6d6a4dffec59ede
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 440KB
        • SHA256 08a02aefa6a47ed67e9b11319af9e8cc014be89cda2475887af466cab26b9a46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.0MB
        • SHA256 f267664139eee8709e74c9d26d4b8473023ff9b3c9d675935336cda581c28f49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 600KB
        • SHA256 c520fd24b27cdebbcf904f51edcf04bfc9aa47e81113c831f22f6ea66e039f73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 1.9MB
        • SHA256 459da138320961c6543553242685390c033503652f0cd5f6c4a86ad9f97c726f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/996-0-0x0000000000F02000-0x0000000000F32000-memory.dmp
        Download

        memory/996-2-0x0000000000F02000-0x0000000000F32000-memory.dmp
        Download

        memory/996-4-0x0000000000E70000-0x0000000000F32000-memory.dmp
        Download

        memory/996-1-0x0000000000E70000-0x0000000000F32000-memory.dmp
        Download

        memory/996-5-0x0000000000E70000-0x0000000000F32000-memory.dmp
        Download

        memory/2760-93-0x0000000000400000-0x000000000049D000-memory.dmp
        Download