Overview

overview

7

Static

static

3

2026-10-25...at.exe

windows10-2004-x64

7

2026-10-25...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/10/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_7f61a29dcce4670a8742836959cf429c_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 2.3MB
  • Sample261026-2b4dashx7p
  • SHA256 6b834fdc3ab6df07af5c8ec1fc46c45026e6142fe43809b7d2b382c4dc829ca6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitdefense_evasiondiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_7f61a29dcce4670a8742836959cf429c_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_7f61a29dcce4670a8742836959cf429c_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Direct Volume Access: Opens a physical disk for reading
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4396

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 70d6d07e9b28fd66b2faab6b71ba89da324f55ce0972fe092beb9d86e2565654
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 0a5c3f8cc2cc99eeec09175e9da2ca83a6a83e71f8480e085e271d3cd8a9bf15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 a3ad1593a300ede603693d33cfd5612353ffe85c6361fdfab694f3abf2b7d62d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 57b66f34dfd76eca1142a8f5eab2d667893c14f3ef4fc0ce16d6dbbce5c8f9a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 b5bd815eb3b3bfc2facf94dddfa7912805e97889d51be4e3c8d3f40e303bdcf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 6267a408653848152cac018a353f7096f853bfc242d28dd04870fe6d2075a9a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 ff4e706bee2e2ac5026680a90eae67d2a1925f0acd5d0637fcfaabb4cae88442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 9338b8abe0bfc28db1ba3b16add87eea01deae7b166b20211f42780fd0ebff4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 f669845c02ef7b0691125826d24a07b59b1fbf4dabb2ff8e3f20f48103ed417c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 554d6e404ea30be81cba8e59325c6bf574330dd07882b8cc8661b231b742be71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 b1cc081de4351bd454265502abec152220ee8f97ef9ce9980c8d3c47aa465ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 3b498250f60b567854b18c6768f2903613de8e963cb8d946dd912ca7706acbe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 2d4b96f327bc09fc00ae322b812a99b0d5baa5b4549f90e436a881a5ffefb019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 9568feacc239e365a28b95bc503d88417d50d5e2c4425168304c9d9dd9d8643f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 ab500e5d6070aaaffead7b881bb700095974c52a8ffdaeead5db8e0559e1a566
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 49a8a959c4e96d5c9e71239389491bec5eaf6cece258ee0cc994419559cda4d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 97c20ec1ec57982d6ed43a0224f121b16365cbbe4bc7eb79a3167006fbd44eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 4e70ddafc1446547743222d2484f816d8c673ce88494c945590b7ebce0c3b275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.0MB
        • SHA256 7436d60ac87731eb7c4c40757432882838cdc9bda1a89e599b19b62dc146624d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 7ac8e45eb5849838bb4c8b260e13e8e13336ef2b175037380630d1e9a1b0ebf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 95ecebe0a2d3cb354b94ef8790963d0fcca8a3cd7ce4d53452401ff797f5ae6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 4dc8ba787c5f585c6d7fa4f4173ef256d73d2555796c6ecc4cce67aac98a4aa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 242090ba25a46b9a25293f5f84b94e6fad0e775714743458077c5f5e8fb96c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 8348ff0c137a1398d5f249504b220a153ebf37f1c8c9233a6cb4dd3500ce665b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 8f15bcee246bb50758c0714fe9535a4c608f88d8da48e872688b1a15b197dbf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 961KB
        • SHA256 76c67e65fb248b6c9cf93ebd44648176556964a601360073f17c90cb2434d762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 976ee5d83d595cb97d6e6ea519a7735f1a277d0e44fecb5de0af6030461c3ea4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4396-6-0x0000000002F50000-0x0000000003078000-memory.dmp
        Download

        memory/4396-0-0x0000000002E40000-0x0000000002EC5000-memory.dmp
        Download

        memory/4396-7-0x0000000002E40000-0x0000000002EC5000-memory.dmp
        Download