Overview

overview

10

Static

static

3

2026-10-06...ay.exe

windows10-2004-x64

10

2026-10-06...ay.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/10/2026, 17:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-06_ed771d6db2de77678f7619c47d49ccfe_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
  • Size 562KB
  • Sample261007-wcmjaadw4p
  • SHA256 cc8101fe0462cce33512b8834a49f5a800c23068c163b2517f5829b9d814eb91
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexpiro

Malware Config

Signatures

  • Family: Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

    backdoorexpiro
  • Expiro payload 6 IoCs
    backdoor
  • Executes dropped EXE 22 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-06_ed771d6db2de77678f7619c47d49ccfe_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-06_ed771d6db2de77678f7619c47d49ccfe_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:5784
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:5600
  • C:\Windows\System32\GameInputSvc.exe
    C:\Windows\System32\GameInputSvc.exe
    1⤵
    • Executes dropped EXE
    PID:5376
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:3204
  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    PID:4780
  • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
    "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
    1⤵
    • Executes dropped EXE
    PID:124
  • C:\Windows\System32\msdtc.exe
    C:\Windows\System32\msdtc.exe
    1⤵
    • Executes dropped EXE
    PID:3280
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:1860
  • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
    1⤵
    • Executes dropped EXE
    PID:1124
  • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
    1⤵
    • Executes dropped EXE
    PID:1120
  • C:\Windows\SysWow64\perfhost.exe
    C:\Windows\SysWow64\perfhost.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • System policy modification
    PID:5584
  • C:\Windows\System32\ReFsDedupSvc.exe
    C:\Windows\System32\ReFsDedupSvc.exe
    1⤵
    • Executes dropped EXE
    PID:2408
  • C:\Windows\system32\locator.exe
    C:\Windows\system32\locator.exe
    1⤵
    • Executes dropped EXE
    PID:5804
  • C:\Windows\System32\SensorDataService.exe
    C:\Windows\System32\SensorDataService.exe
    1⤵
    • Executes dropped EXE
    PID:1908
  • C:\Windows\System32\snmptrap.exe
    C:\Windows\System32\snmptrap.exe
    1⤵
    • Executes dropped EXE
    PID:4760
  • C:\Windows\System32\OpenSSH\ssh-agent.exe
    C:\Windows\System32\OpenSSH\ssh-agent.exe
    1⤵
    • Executes dropped EXE
    PID:5740
  • C:\Windows\system32\TieringEngineService.exe
    C:\Windows\system32\TieringEngineService.exe
    1⤵
    • Executes dropped EXE
    PID:5396
  • C:\Windows\system32\AgentService.exe
    C:\Windows\system32\AgentService.exe
    1⤵
    • Executes dropped EXE
    PID:2132
  • C:\Windows\System32\vds.exe
    C:\Windows\System32\vds.exe
    1⤵
    • Executes dropped EXE
    PID:4088
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Executes dropped EXE
    PID:1276
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Executes dropped EXE
    PID:2728
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Executes dropped EXE
    PID:5512
  • C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\SearchIndexer.exe /Embedding
    1⤵
    • Executes dropped EXE
    PID:2060

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.6MB
        • SHA256 5be751b113a41804cded7c7f987c92d79179fb74339843b0d7ee87a5503efcf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 658KB
        • SHA256 2287d389033cafe6352449f08cbeca370ece17e2168faa964b1edae8c3d2fe86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 637KB
        • SHA256 097198d82e13bb78a18a447ee8c40706f484ba54118a1c25ecc155c79fd17bca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 2.6MB
        • SHA256 c1ef60956b8487f60195fedfa8b0c51aa3420b953a714853442136b774d21f18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lkobgeqj.tmp
        • Path C:\Users\Admin\AppData\Local\obffpkok\lkobgeqj.tmp
        • Size 646KB
        • SHA256 5c1e10851695b6fe0fee648df732aaf61c38b7a953b682cb376152a7d34b84ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 420KB
        • SHA256 da003e3703120f0f7fb71e50edfa91be8128161584207b896e54f766095a8cb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.2MB
        • SHA256 34c04c2f84e77c7c776eb569d8749415544e88d30b66004efc8db09a8b9100cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 464KB
        • SHA256 e2cff25316e6d23625474b698be5ad298290bf25b59d0c07048321bbeb540d07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 428KB
        • SHA256 8fd66a96d99456a8cdeb92cee3b46632d1c4169a30b337008c60c50578bfedd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 944KB
        • SHA256 aecc353d841322568e418872197230090967c5491d728b42672c8149bce9cd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 632KB
        • SHA256 edc695fcfd62a678936a292b23079ebe078ffc71fafe55b663bba3405df6b0cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.5MB
        • SHA256 b7072747a298ee8838fda6046db5e93fc68f69b0e1afeded630215f71229f761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.3MB
        • SHA256 085c83de191e7e736a90bd0b9c577e08d024ef50472fc03d229056293f4cfb65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.5MB
        • SHA256 97b2cc680f7830e4c1e850cf0a7652ca4ab3842388367db7f44c5358fc82286b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 736KB
        • SHA256 7293fa47cea2c2fa505b02157cd66d1088a65b8a4ec6f00b198e4ff7ce4006d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 1.8MB
        • SHA256 7f49f824714291f6e8873438d8566de04b125f430e21b6713598eafe5b3e18ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 580KB
        • SHA256 8b26a276c8a4c887b5793c1b1814e8da98647a9fe53f72e4e64bf6fe12287972
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 564KB
        • SHA256 060a0574900fd50d667dc81ee67b5500669a97674eb7e305588988ab1122959b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 572KB
        • SHA256 dc05642dc9b7cbd97d41f17120c83ae129d438e73a651d1d37ddfaf3176b04bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 436KB
        • SHA256 a7dedd084f9fdfb52318aaa09bf2f2b80c1f6e787fe1ac138c88a5892793ebcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.0MB
        • SHA256 9b12c924569092f178f02336ffff88c03c2a684d6bf7a90363cf2ca29041facc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 596KB
        • SHA256 6d3eb26e04cc95658185f2d04d32d1bdf22063c87a92b26d1f7a6b7b95a518ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 1.9MB
        • SHA256 2d8139db39eaabbbfc806881d068502e72c9fcc9d62cba2dadb2d923b1c0d0e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5584-97-0x0000000000400000-0x0000000000501000-memory.dmp
        Download

        memory/5784-1-0x0000000000A60000-0x0000000000B86000-memory.dmp
        Download

        memory/5784-2-0x0000000000AF1000-0x0000000000B86000-memory.dmp
        Download

        memory/5784-4-0x0000000000A60000-0x0000000000B86000-memory.dmp
        Download

        memory/5784-5-0x0000000000A60000-0x0000000000B86000-memory.dmp
        Download

        memory/5784-0-0x0000000000AF1000-0x0000000000B86000-memory.dmp
        Download