03cea28b28a9d5b7210488acd1b83d480581d699eefe44e24cabe3dcf5fcd243

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_eebdec4cd9bd591672f0bd62f7dbc621_amadey_elex_mafia_remcos.exe
Size 999KB
Sample260910-b868cacm7s
SHA256 03cea28b28a9d5b7210488acd1b83d480581d699eefe44e24cabe3dcf5fcd243
MD5 eebdec4cd9bd591672f0bd62f7dbc621
SHA1 185965755aa8c005c2e2a8acd6faa483e25968aa
SHA512 d4e7301f9d900061bcf8ddadc3980b2eda2c5e1279dab500fc5c0df0700d133023bd056210292099fe48241f51b6196ba30cecd5097c502e9897e4a8e2a1bfe7
SSDEEP 24576:bNEHd0EKpxtJFt8R37t89TMFZ2qrrNYpXxfltbd9zJhuYJKYbjP:bNEHJKrtJFOrt89TMn24rGxfb3zJ9bjP
TLSH
T16525F116B784E033C53301358E16D7A8A9BDF4B188215407B7E8AFBD3F715C2AA35B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3656	alg.exe
2720	elevation_service.exe
4428	elevation_service.exe
2576	maintenanceservice.exe
4268	OSE.EXE
3680	GameInputSvc.exe
5144	GameInputSvc.exe
5340	msdtc.exe
2728	PerceptionSimulationService.exe
2724	perfhost.exe
2424	ReFsDedupSvc.exe
3048	locator.exe
2216	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9bd2e13e24febf98.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_eebdec4cd9bd591672f0bd62f7dbc621_amadey_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_eebdec4cd9bd591672f0bd62f7dbc621_amadey_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_eebdec4cd9bd591672f0bd62f7dbc621_amadey_elex_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5144	GameInputSvc.exe
5144	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6052	2026-09-08_eebdec4cd9bd591672f0bd62f7dbc621_amadey_elex_mafia_remcos.exe
Token: SeDebugPrivilege	3656	alg.exe
Token: SeDebugPrivilege	3656	alg.exe
Token: SeTakeOwnershipPrivilege	2720	elevation_service.exe
Token: SeTcbPrivilege	3680	GameInputSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 5144	3680	GameInputSvc.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-08_eebdec4cd9bd591672f0bd62f7dbc621_amadey_elex_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_eebdec4cd9bd591672f0bd62f7dbc621_amadey_elex_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5144

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2728

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
PID:2216

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:1092

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0f9956f425989bdc6f4757b703a423cf5a08125f1ba61fca9ec03cc03fd7e366
MD5 5f65e4be1136c0527546f42ca3246b44
SHA1 0c972e1af71db449395c11f74d610335c0a71d99
SHA512 1a8cbd2f6b49490d260c97c15dba7eea3aac74c977a9a37bded6ca29b9bc0a9a7dd203aa621d89a90bf2f117d18ca92b784c97b22e0be752b0cacb4414468b5a
SSDEEP 49152:kb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnwRGxfb3zJ9bjP:e3q6gjB5RcD3zJ9b
TLSH
T145D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 a2b09b35b6bce1528978570ab71d2e42331c811ae26449fee20dd808aa935851
MD5 97e2e8067663ca89ce3a451590ed255f
SHA1 20cf10b828117e4c7be1bca45ef9bf7e4cc94236
SHA512 2d528fa2b79b744dc00e742d19e8abe82973f90e8a0bf3dce3f5f51ed0bdd055f72d0bd77754e27afcfbbe63e9814a2c1d376f17af9547f5461093a500286d77
SSDEEP 24576:7XYfDtczABNYpXxfltbd9zJhuYJKYbjP:etcmGxfb3zJ9bjP
TLSH
T14905F129B7E408FDED57C13CC862C502D67378668760FA9B03A489651F23B9C5E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 3428d39d24019afac9c5df9d586c42535ca39e397093fe41b32b347261546ba0
MD5 c69ddd71f424c61aeb23bcde9a5df72c
SHA1 00cc48d980be0cd3a3e34c5ff65690ca98f1b702
SHA512 c900c57dcbd8535500ad5e1cb1e9b4ec14a28808b317faaf34bf66da58dfecb5a915b7884903f37b706b91d782c2c70cb1a185fa26dbada48769379003627b44
SSDEEP 12288:Imw5HEjsChNYBFgl0WUm+Ct7NYpXc6QtjGIOltbd9gMzJhuZ+WcOf2UOd2GjQiF7:lwuROWFNYpXxfltbd9zJhuYJKYbjP
TLSH
T1B005F14676E41CF9E99785388557C536E7F2BC122A21EB1F1320C68B1F37725BE2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9a6d4b1e60479748f44a14b859d17870e488231eae7ca795d594affd58a56aa8
MD5 04a511160316442663f9afffb8f51872
SHA1 62d9bfbfa9ade225502355a7ed543b3b28ede7cb
SHA512 76cae42591ed67237563ee68ba0c6a6288912d09ecc9bf6ece864e2f00253010e4021bd437365ca54520ff7a14ce035f5db8f407f8c9bb434fc9f177035f9369
SSDEEP 49152:VB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl4Gxfb3zJ9bjP:bu6JmTxd2d4cD3zJ9b
TLSH
T1B8D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 f6c0cbac4c5d5137cb81e14a9b2a1b00292baaac6100f33c1678b630a47eafbc
MD5 8d0b041274f5511cc4f654db5a344ef6
SHA1 f25743ed21c1363381b03afa8369198b8cf68cbc
SHA512 06ac0c5801a93edc270339e1af3691527a205f2eb85854bf837c34b3cf80773e61fdd747551fe44ff322b2668feb3a7959c5cdce9ac300b5ec96d8d599ed9497
SSDEEP 12288:c77ZNYpXc6QtjGIOltbd9gMzJhuZ+WcOf2UOd2GjQiFkAlXA+:mZNYpXxfltbd9zJhuYJKYbjP
TLSH
T153D42357EBBCA42EE94BE8342426D44544BEB83BC710BC9FB31505C41A67E8C6AB137D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 bc7b489ea0243139148ce37f78549ce2605b14c32a95ac468e366e7e66988ab5
MD5 162bca1a04c2bb7872588bd674ee0504
SHA1 27d4e998ee7a9eb16c71faa2318685a0d71b3dfa
SHA512 2ab4df729f797e5f81f43103e2bed30dc7ca8fb371bf27c5bcecf7e23d069b41599eb2ea246c5ea5a4a5e5b388ce4d3a3e2785a3791b5c931c02a3634c6a196c
SSDEEP 12288:LnGPNYpXc6QtjGIOltbd9gMzJhuZ+WcOf2UOd2GjQiFkAlXA+:rGPNYpXxfltbd9zJhuYJKYbjP
TLSH
T11FE4222FB6F970ADC91BD53864229483A4B9383287107CEF532485B44F67EEC7275E68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 4cd210477040762a5c8b41ee44ec6e8ffaac687a0b406af8663b87c927c98985
MD5 54e9c7db444b7a5a8b0e31b54509f8fa
SHA1 e395ea577e21cfdf8c5aab7067970318462236b0
SHA512 af7efa6abec35d1db2dd8a075d95774364eda337c18e6e8d2c1ae07d7d78fadebee3b906cb5dafb06eebafb99c8dc3ec1b0a4574ace59075e5060fa10ef501ed
SSDEEP 12288:A5NYpXc6QtjGIOltbd9gMzJhuZ+WcOf2UOd2GjQiFkAlXA+:A5NYpXxfltbd9zJhuYJKYbjP
TLSH
T1AFD42347FAB8A06EE947E8342423D84644BD783BC3517CDBB32515C00A9BEDD76B12B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 616840151416e6c701fcd1e8f04bfb329e182f84fecd99dd4de918eeae826664
MD5 80a4a6f96ea5e590bc63385afb405e34
SHA1 89c3c21d45659aac1e7ca4db0b72372fdcbfc173
SHA512 c0dc561c666121c7082d8120ff32f3ead5588a1340ed0ee20e146625a0fc5e22ceffbcbd1a9e51b273f9ee6596d35b58ddb3c4bbfad70a81a5141b2282fc2e39
SSDEEP 24576:Msa8u8FpJqH1Mzria7/mXNYpXxfltbd9zJhuYJKYbjP:FpZFPqVra7/mGxfb3zJ9bjP
TLSH
T14D35F166B7E001F5D47BD03889424653F6B2B4260364FFDF07A88A911F23AD94B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 adbd902f97bdca59e254f848ad945c31f42dcc69fd1d1a11ead0396007c69681
MD5 5919151d4dcfdd7eac9c46adfec45a23
SHA1 7887daefc3dbd7e347f972aab4933213fd9ccff1
SHA512 785fa61db2296662db9ccaca617880a83793f30da4ac8122f842281303ce1d36ec7463bac0a37cfc333394212f888ecd5b7fccf42fbceaec104af9fbb54169ed
SSDEEP 12288:QHvUrBFrEjwaQllNYpXc6QtjGIOltbd9gMzJhuZ+WcOf2UOd2GjQiFkAlXA+:QPUr+NQzNYpXxfltbd9zJhuYJKYbjP
TLSH
T11A05E11F66EC18E9E667E13C85428609E771B4664312E6CF03A1817E0F67EDCBD39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 97de2f1fbc0f2cc0b1583f3c6fe3d084aece86ee2c90b4bf619519eaf2e23a0e
MD5 59b571d3b9ecd81a8175f94e0768bed8
SHA1 7485e67c409fdfc192eafb15a5f566a337b283c0
SHA512 b56ae756661eea028863a3333e29b60c5526c0540844f2d188b7133a58f866b1d5fe3efb064fc1059c1fc05178a05ef77062cd6ae78242e1e0abaf27aff13e6c
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj3Gxfb3zJ9bjP:uG05lO43b8cD3zJ9b
TLSH
T144D5CF6E62EC11F9D1BBD07CD9868A0BEBB23425033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ccd09dd8398f6bca228d3dd67c3640d529f38acb9dd454087a95724f6e14cbde
MD5 d64ea582af500dcfef47edfccf09f777
SHA1 608ea16f679327611320193b53541182bfeead88
SHA512 0cbcb09cbd49e1e71ec2dd653e23e871ceb003ce23e2b8e61ee652f9a9455dc4ae85adf150fa5944d1c8af7bab95515d9afa9eb86f8f3139fbc2f5b28c632895
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkeNYpXxfltbd9zJhuYJKYbjP:sNc/zEOVHFLGxfb3zJ9bjP
TLSH
T1F7858C1623E901E4F1BBE1BE89779546FAB1786553309ACF0291811B1E73BF85C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 0d27901cae8e2929d591794deca6d562c8e60ea8863acc1ffc04d934f5956a95
MD5 41d14b45d8ebd5b5988e4d142002ccd7
SHA1 2b319513fdd8fa72bd634ac526ed53d30801a506
SHA512 1fba7dbd0a2e9ac2928146590fd0d74dd403fda65d85a90776635ce0ffbceca8e2e183c6c5551c83748d4fe8b0b04b2c02ecc8f90933fcaecfaf50417c2279d8
SSDEEP 12288:r1Hck6j5ZI7QNYpXc6QtjGIOltbd9gMzJhuZ+WcOf2UOd2GjQiFkAlXA+:v6DIsNYpXxfltbd9zJhuYJKYbjP
TLSH
T145F4015E73BA20FAD06BD03D95834502D1B2B472C3226DDF07A485B94FA3EDCB939A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 e955188e2b0f70be8a700415377be868969e7f1af7fd122228b31b2f165b0521
MD5 b44d03fa4efaaccc509eeaaebe6f84b1
SHA1 801aeb5b2f02ed38f1a4926af11a0f8b29004ad0
SHA512 31cb3fcd911504b4d0230be24c2501456a57dd85717d278e8b78243b86442fb1385dd1b26d597f21c7090971cabf2b8dd00eceb779b32b196673fb13053d894b
SSDEEP 12288:sG6kyQNYpXc6QtjGIOltbd9gMzJhuZ+WcOf2UOd2GjQiFkAlXA+:ttyQNYpXxfltbd9zJhuYJKYbjP
TLSH
T1F6F42206A3B870A9E99BD438592381818A79BC318711BEDF6320966D1F37FCCB971725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 c135eb9cd36d24ac2733fa51630f166ce8b94b78f574090f52bd59785094ebcc
MD5 70faa6ef0eb536c8fd743d016b0e5945
SHA1 4270e8ca41a227236943f1bbd8bdea973e27b5ef
SHA512 62fee5835c351e7efd4bbd5d6cc794a389695bf42f36cab66cc747ab185a5b54d7ed04254633edb4f6dc7ad6f445fc25fa3f565a303007e25a21d0cd8b6a0752
SSDEEP 12288:nqIdNYpXc6QtjGIOltbd9gMzJhuZ+WcOf2UOd2GjQiFkAlXA+:qIdNYpXxfltbd9zJhuYJKYbjP
TLSH
T16DD4235BEAB8706ED947E8342022998680BD783BC7117CEF732545D00B6BECC76B1679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-317-0x000001CB42610000-0x000001CB42676000-memory.dmp

Download

memory/1092-316-0x00007FF67E960000-0x00007FF67EA13000-memory.dmp

Download

memory/1092-318-0x000001CB42610000-0x000001CB42676000-memory.dmp

Download

memory/2216-305-0x00007FF607010000-0x00007FF607426000-memory.dmp

Download

memory/2216-307-0x000002441CB00000-0x000002441CB66000-memory.dmp

Download

memory/2216-306-0x000002441CB00000-0x000002441CB66000-memory.dmp

Download

memory/2424-290-0x000001E1D4A40000-0x000001E1D4AA6000-memory.dmp

Download

memory/2424-289-0x000001E1D4A40000-0x000001E1D4AA6000-memory.dmp

Download

memory/2424-288-0x00007FF6B3CA0000-0x00007FF6B43E3000-memory.dmp

Download

memory/2576-50-0x00007FF714130000-0x00007FF714297000-memory.dmp

Download

memory/2576-51-0x0000016330410000-0x0000016330476000-memory.dmp

Download

memory/2576-52-0x0000016330410000-0x0000016330476000-memory.dmp

Download

memory/2576-57-0x0000016330410000-0x0000016330476000-memory.dmp

Download

memory/2576-59-0x00007FF714130000-0x00007FF714297000-memory.dmp

Download

memory/2720-31-0x000001AC0C340000-0x000001AC0C44A000-memory.dmp

Download

memory/2720-34-0x000001AC0C570000-0x000001AC0C5D6000-memory.dmp

Download

memory/2720-32-0x000001AC0C570000-0x000001AC0C5D6000-memory.dmp

Download

memory/2720-33-0x000001AC0C570000-0x000001AC0C5D6000-memory.dmp

Download

memory/2724-276-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2724-277-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/2724-282-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/2728-264-0x00007FF651A20000-0x00007FF651B69000-memory.dmp

Download

memory/2728-268-0x0000021844D20000-0x0000021844D86000-memory.dmp

Download

memory/2728-270-0x0000021844D20000-0x0000021844D86000-memory.dmp

Download

memory/3048-296-0x00007FF6921C0000-0x00007FF69226D000-memory.dmp

Download

memory/3048-298-0x0000027015200000-0x0000027015266000-memory.dmp

Download

memory/3048-297-0x0000027015200000-0x0000027015266000-memory.dmp

Download

memory/3656-17-0x000001E8B85C0000-0x000001E8B8626000-memory.dmp

Download

memory/3656-15-0x00007FF655FE0000-0x00007FF656102000-memory.dmp

Download

memory/3656-16-0x000001E8B85C0000-0x000001E8B8626000-memory.dmp

Download

memory/3656-18-0x000001E8B85C0000-0x000001E8B8626000-memory.dmp

Download

memory/3656-49-0x00007FF655FE0000-0x00007FF656102000-memory.dmp

Download

memory/3680-238-0x00007FF709880000-0x00007FF709948000-memory.dmp

Download

memory/3680-239-0x000001DF3EE90000-0x000001DF3EEF6000-memory.dmp

Download

memory/3680-240-0x000001DF3EE90000-0x000001DF3EEF6000-memory.dmp

Download

memory/3680-315-0x00007FF709880000-0x00007FF709948000-memory.dmp

Download

memory/4268-63-0x0000019EE8480000-0x0000019EE84E6000-memory.dmp

Download

memory/4268-64-0x0000019EE8480000-0x0000019EE84E6000-memory.dmp

Download

memory/4268-62-0x0000019EE82A0000-0x0000019EE83AA000-memory.dmp

Download

memory/4428-43-0x000001D668F50000-0x000001D668FB6000-memory.dmp

Download

memory/4428-41-0x000001D668F50000-0x000001D668FB6000-memory.dmp

Download

memory/4428-40-0x000001D668DF0000-0x000001D668EFA000-memory.dmp

Download

memory/4428-42-0x000001D668F50000-0x000001D668FB6000-memory.dmp

Download

memory/5144-325-0x00007FF709880000-0x00007FF709948000-memory.dmp

Download

memory/5144-252-0x000001D6B0930000-0x000001D6B0996000-memory.dmp

Download

memory/5144-251-0x000001D6B0930000-0x000001D6B0996000-memory.dmp

Download

memory/5144-247-0x00007FF709880000-0x00007FF709948000-memory.dmp

Download

memory/5340-250-0x00007FF7FAF80000-0x00007FF7FB099000-memory.dmp

Download

memory/5340-256-0x000002BCF3300000-0x000002BCF3366000-memory.dmp

Download

memory/5340-257-0x000002BCF3300000-0x000002BCF3366000-memory.dmp

Download

memory/5996-326-0x00007FF69AE70000-0x00007FF69B112000-memory.dmp

Download

memory/5996-327-0x0000024955970000-0x00000249559D6000-memory.dmp

Download

memory/5996-328-0x0000024955970000-0x00000249559D6000-memory.dmp

Download

memory/6052-0-0x0000000000380000-0x000000000055C000-memory.dmp

Download

memory/6052-28-0x0000000000380000-0x000000000055C000-memory.dmp

Download

memory/6052-6-0x0000000002750000-0x00000000027B9000-memory.dmp

Download

memory/6052-7-0x0000000002750000-0x00000000027B9000-memory.dmp

Download

memory/6052-1-0x0000000002750000-0x00000000027B9000-memory.dmp

Download