Overview

overview

7

Static

static

3

2026-10-05...op.exe

windows10-2004-x64

7

2026-10-05...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/10/2026, 17:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-05_af607ee63e902b061b35fa146a210d6b_darkgate_elex_maze_rhadamanthys_smoke-loader_stop.exe
  • Size 905KB
  • Sample261006-vm9k5aff76
  • SHA256 58424195f49129c81ae0de5541fab0f36a6a16648c03f1edd1f9730df663e2a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-05_af607ee63e902b061b35fa146a210d6b_darkgate_elex_maze_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-05_af607ee63e902b061b35fa146a210d6b_darkgate_elex_maze_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5564

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 ac8bb212b188517cd2023f1a4ac4bbeb9bf9b5b957460c81e96079d06f4015de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 1575ae4ed6b9e91d26d6959bee051221e0adff43c4d8719884f4abc0c6e9d949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 45fc4b2f6846b41f6c065321205b43c9d8146a133449cdc80d1b908e711bedc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 6f0854c9cb216732d28f37e94c420c80d740f078e517aed8bb49ce87654e62f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 bec876e876be197b5230dd9ee6132be658ea5e99283d3ec38bea635765b43aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.1MB
        • SHA256 955c3dcb414505dbaa458fd09e34469afe3c1a1dad837beedb2e60bab84b61ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 f6e222f4f35e3f9ee6a56e41433c8192597422e599e4c4af844ee4aacdc7aaaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 ceb7d99e2ba05df9a0aac6418f7820945750b0fe33ae719d1ffb0578e3f72176
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 eb081d7574d2669b7d9ff52210df2295dffb7fc858e49b962540b0f2b312bfdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 84e7a4a0fd1eea520bbd742e9be87ac5c9e03c40da9be888761d66b474d75342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 34349e276abcd3f1236d04251014f6af69054506eb37572673f33d0704a35f07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 99d30eef8ff33c5daf7064d768dc619910aed7789b7ec653eb5b8d5287e5b44e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 9ad533078dec5673a278e994224fe199a09288b06bdfb264714396b930d28890
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 d257ba707e665e5847156361181bd5677cbf2098e0a5d1679fa950324e7212f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 9637400e9886a63a258941eb7508bb629f1bfee2dda6d84d045126c7ef703576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 2498b681f716a723ccc3887dd99ef9929ce45f1d3ada4367dc07a920152f72b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 88903267a9f9318d54da184333237f422998adc89995d06ead8a9e21d97171ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 d7e5b59670b46c0d804d1f4208a343a9c800e303898d4f444b928fe64d37519d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 34b1e8dab0907185e21c81e625e23118b307632e27d5a734f5a350e7c520810c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 f33f0e7d7570888258a289a41bc92c15ffff7cfd35729ecfdac8aa4689268815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 850ebfa59115485f936dba56bc71ed8794517071cd35ac68ffd08c582329e26e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 e6ede6b3fd45f3fd36426cac18e8dfbabf05fd42fc9e4abc2642393ad90b4352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 2eeab3bff8c61ed05718e69a7b8e31784f0b897b604f84189ff8f8ff18c5c379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 14KB
        • SHA256 ea6da08b18662c870f31b03174827c609d385ef6c470a1f275421901f3315f77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 06dda5fc2af3a61c5aeffc37d69558b0479ccf0047310ca30447c6e4a010043f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5564-14-0x0000000003EF0000-0x0000000003EF1000-memory.dmp
        Download

        memory/5564-6-0x0000000003140000-0x00000000031C5000-memory.dmp
        Download

        memory/5564-7-0x0000000003140000-0x00000000031C5000-memory.dmp
        Download

        memory/5564-13-0x0000000003EF0000-0x0000000003EF1000-memory.dmp
        Download

        memory/5564-2-0x0000000003140000-0x00000000031C5000-memory.dmp
        Download

        memory/5564-0-0x0000000003230000-0x00000000033E3000-memory.dmp
        Download