Overview

overview

7

Static

static

3

2026-10-22...at.exe

windows10-2004-x64

7

2026-10-22...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/10/2026, 03:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 3.5MB
  • Sample261023-ehexyscb68
  • SHA256 c6eb2604bf9df6a4da1967033bf4aaf71d44e699a2fdddc0b8ba28506219cea5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_ec3c9a60442e3be0e3cccb0032afdaec_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 86fd6d53124f3dc85b248499a0e814434bb28af355ee45b899f81075fd21c8a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 5d8b0bb4835f19d2b41aa0e52168636a44fafff58f4c12a80a74cd78e1452dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 726f200220063dd9e5963463cfbcfaff3b8be463fd9958f126d3db1dd59655ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 c4fdff805c2792d24a5d68b78685e4d12dfadb786317c41b1a35ce8d690da8bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 777KB
        • SHA256 0ad086e51b24cbb3904ee3c5ca568b1673cc577d4540c463ff471a60beeba969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 170f64383d231bad0a03a919773b9339e07733a08a37a70ff7d80872c8e6e538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 1db2bac4cf5669786d189754dbd497a551e16cf44688f3d709411676e13eeacd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 186a08c40775c8e1f33f94707585cd5838674a5634eaf7d59cf523a9227b7325
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 fab279fa581089fec2ca1914a6129f3b0ce566830d34257c4d3bb9a98127dd50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 ebf387328ddc573f33f5088579f7509eba3fa4d998b54c0cb7cfa96ed86bc5fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 c227fadc0760dac7587b49e454ee190116c175ca95452f2cc3c4fe7a88169279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 07c2e057f1e62a44d904e5b8561e5ab25947bcc4c3668a16e54e38acc7c6ca95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 71a5d0ad6f6e9733c37d24f0b05d9c0e2d3caa0d353550d9cb5592379cbd38a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 1bb0d3e24c378ace4afbb38bd056b879537fef6e5e13d1c8c9bbc9d851d56c49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 a6ecff160d9cc9c679c8f21c94371a15b703b60a5ddf36b4737b97f8e068854a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 e1e7e2671771bf2d303144caf425bbcb94d42e9627daae9600a569ff25efad64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 ab909b58eb646b41bef8b72121ee0483a67b058973a64f0bd789b7b1df187fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 c3146f5e025a563d20df8e75671dabdbf144d84dd6f36a5556fa1c366337830c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/976-0-0x0000000002B40000-0x0000000002BC5000-memory.dmp
        Download

        memory/976-5-0x0000000002BE0000-0x0000000002D6D000-memory.dmp
        Download

        memory/976-7-0x0000000002B40000-0x0000000002BC5000-memory.dmp
        Download

        memory/976-6-0x0000000002B40000-0x0000000002BC5000-memory.dmp
        Download