Overview

overview

7

Static

static

3

2026-10-22...os.exe

windows10-2004-x64

7

2026-10-22...os.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 12:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_5577be7fc53e61c9109de4eb8baf5b23_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
  • Size 3.6MB
  • Sample261024-p47j7svsbs
  • SHA256 87188b37a3e17c7e80efffe15e925dd768d6438a6a648dba9fe86ebe1eae0d74
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_5577be7fc53e61c9109de4eb8baf5b23_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_5577be7fc53e61c9109de4eb8baf5b23_amadey_darkgate_elex_luca-stealer_magniber_njrat_remcos.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 fb83e467ad26f115d36dd957542d364456378b33237120e52824b998306e332a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 b6211a95e17b11b675ce226d611bdba9ee1cc28b203c1e5634c4d8146c5f9198
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 08782afe1ccc9675822e69a1d540e98ae4e08b0f1cd9ae908e85378679064532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 27eac13210bf40c7de6b1404fa13a8bf248efd0d149f716cd3328d40cef22522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 b689e438544d2104873700b66ef216eac41d27316ff4825cb9d95f2ef5ed39f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 1cf28f19fed5cf8dabbd50c75e9dc424a9a0e6557ee9a7c0193712b699dc1dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 18bf9fdeeb3f35d4f5f7527055923c78aaeb507475fd0fc84333410eaf09a5c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 a849e26ed331296c18540c162f6fbdea105ad5abfac06cd4109ad4d9ff2d3291
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 c79b16c3ab29243ddd6844a63e5615b0fa8f2db0e54788f29746c56cbb1f388d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 bbe03ee62edd7067d1a66d59df7b60a30b40c64696e0405b6fcee1f4b6ebdeb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 cc256d0ac8cbca29688ffd371b57749d5c601422029c41351fabd16fa1c892f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 28ebffb7e72d5e4b1fd7898384e49582017f8f49e9a5449ce1b75597aa5e6b7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 cffb5ce20713af169973cbbee3c51b3356ece84d77e6f53fce1aa71e633c9ea2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 692390d5db6bea209f3434be2fec805de6a8fdc00cc913fcc16fbaadfeb1a120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 052a5137b22a2a16140bf0b86a185bc4fcb002c409fbb7695fb4691bfc228020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 165d940708a5593065a51f00e910d2048f211b47aad1c7d36e1c7a86fdc5e21b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 33bdef99f24f5f11abe22ad9361c4bdd98c7d2a534b71d541bdbdc7c7add7690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.0MB
        • SHA256 c36a561dfa9f245c3cd94b1062efb93d0d9f5cc7b8e9009ecc6159e7295f5d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 e24bd81bc1e15359416f6c9d511bb04ffa7152c65562360d7df1d8585a3a10db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 5bbaf9d2b41c9f4e73dacf5a244375c7204f2b535fb4cba39814566d1b75bbe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 f4f0bad7ebdf9557fd93358905a7a0b6e6ef57d728077fb5701c15613793fb0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 3c1c55a0cd45a37424859dd941aa78b832bf3885ae48f413d261fa43c9544080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 d3164e82070b8549ac1f101d464c838f01a68a65600fdd70ea97601574b0c702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 65059585e4e319156eb059ab8ee28540e11a3991e3d66f991021be744c9351f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 961KB
        • SHA256 96f6fb6556c34b89a917696f308813a3df12883d2dd857c46cae3db233613149
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 44ef20fcca92a01168984713e674b2f380392e773f2bfc806c9592b6cc75e01d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3132-0-0x0000000002CE0000-0x0000000002E7B000-memory.dmp
        Download

        memory/3132-6-0x0000000001440000-0x00000000014C5000-memory.dmp
        Download

        memory/3132-1-0x0000000001440000-0x00000000014C5000-memory.dmp
        Download