Overview

overview

7

Static

static

5

2026-10-02...er.exe

windows10-2004-x64

7

2026-10-02...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    100s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/10/2026, 10:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
  • Size 920KB
  • Sample261003-mcjb7axyfv
  • SHA256 9c3e2c1c176dc595530ab72059866228e79aa9b030e69b37a0790cca11fd9279
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_71e06660b29dfc4c7b0c2848f55b59ec_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 b1e392517bbc22a8d1ccf7dcd68f0fd8c050380d116b549917f8ed4891366736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1021KB
        • SHA256 b9c244b4c646931e5685469ee72ad14766f11aa7bd6ec9e6c82e2a00dc449e21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 1001KB
        • SHA256 d53c321c7542050999dd9d792a9b2cdad00bee795ce80dac14988833af1339b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 804f08990a7b32a57058ccb9d88c1a0e125293f67f896548df493f6e2748954e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 da19a53f412a3eeae1773140acbd996f64a8a4f63f3004d54d2bef34f43599ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 d239f3225a4d03c8b76392ea6ec0e0f6486fc79f672debf116ff96f9c749d169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 2d4d9241b80158875253e706976a48cb72c0456a6fe034e3d56b85a0c7b055d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 ac49116e090a702d61094cb84c4b870846b773c1615854855212b19eb2ae5f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 782KB
        • SHA256 bc9d41f1f10b27911be78e62dfd1a4d6a93962fed74be230c33aa3099771ec22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 9c036d2fa94bfb19d7b7f55baf7f30aac56e663bbcaf7d9ee1fb99079bd2684c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 cfdf3a31331eea28a8b73452d9e6be8cb803db704186a282e544bce05d31cf8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 2428d76e68914f97baf8ca82eff2faac5e4b908214ea3e0267be6928a7954d3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 796KB
        • SHA256 60a04855e5a2ceee44227a36bf798eb6151730e31bf272bb0e8afbde8c95d106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 5aeaf9e0e70878df065c8c8e88434137799f630028bf186be614031cb3698e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 f319b5ec5a8fc6f1cc640efdd9ad75d9a2aad59dfb93c60fc9297f76bf758caf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 16b3e2a9ee9ab9a36fa19844e9e28aa88b55957e7f0414e4fc025213895de06b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 a56e63693f886f732e123842b466bfb8d06ed7d7167ca1c6a4b76a425a9ab762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 f55c5a4d15234204daad00d0a80cdcdbc05067ed297fa163ed0124aef9403807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 8677d8b8640a2d215031cc2e92ba7e9efa7dec76399d7bcfad075acec94bab94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 d28ebd4d1120b291f76ed3acda48434672dd82bb1c0ad98a814acbc8d492433d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 a04b014711dd286c4a5c4d66179e84ab26b45ceeedca549eda3f5bb8ca87db18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 8580b7961df02660a0ed736e2373700edcb1c21c823f996fb875c2acfe0625d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 fc7411766c8c8bbf3cfe78618f80ec0db1b531826b91201c552e611a8578cde7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 940KB
        • SHA256 d4098ce492d400b3f0b0a5a67f73ae4901a12b4c463bb76d18c785f72b21c2f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 d133a77045f8ae1d5aeca0b6f2afe3286398ad8084e13e76e51f954203a96888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 993f964a517f266e356ed48403a026cec69a68ccfaa79c9e8a67c29aa22d6226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 f19ff1efcf90393143f8cbd148fb5369bc5dffe016a9f2c9f77b3356c9902a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 f3e163a411449fbf209ac4782f1abf875c0d43d311d3940ac2621757aaf8a06a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1216-13-0x0000000000F40000-0x0000000001082000-memory.dmp
        Download

        memory/1216-0-0x0000000000F40000-0x0000000001082000-memory.dmp
        Download

        memory/1216-6-0x0000000000E90000-0x0000000000F16000-memory.dmp
        Download

        memory/1216-7-0x0000000000E90000-0x0000000000F16000-memory.dmp
        Download

        memory/1216-1-0x0000000000E90000-0x0000000000F16000-memory.dmp
        Download