Overview

overview

7

Static

static

3

2026-10-25...at.exe

windows10-2004-x64

7

2026-10-25...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/10/2026, 13:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_c2376077d32c7e6ba30d80abed9fbaa5_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
  • Size 1.6MB
  • Sample261026-qlstrsw1ct
  • SHA256 d2c2e7a659a770d568bd38f5ad338fbcd32edd3e57c2819ed47fa6d6aecd8cff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_c2376077d32c7e6ba30d80abed9fbaa5_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_c2376077d32c7e6ba30d80abed9fbaa5_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4660

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 c0108c5cf9676a55afbbdc8c2c69039a624063a2198e16043e4d5709b65ab1e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 21c245a1b1031583bf07990ccfc73dc18c7baeee69297d42d2ffdb1d8058590d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 998KB
        • SHA256 4aa00ab91d0bdf57314e90a5c811863e6ec1e38fcd59a101e474e12fdcadd5b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 710beb66015c31db2e885bcfc40c732bb247703d8327d9a14e5fb6f883bc5ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 fcb0dfa15af06b91bdf51ce2b7bb26f19610a34dcabf759eab767bce2282f78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 7c4d5b3131adf6954f694545a01318f031a32cdc8b6febe78bf473b629a15032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 7a6624aedf1e8c049b856993f6f9dd8ceadf702b39512ea9381c9b6ff0bd30e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 02d5a24daa5b0bd78c4b4a15bd1084b2f7aa4bcfc7b7eec388df512b1c466ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 4f45d1e7426283f696a2a975369004a60e7d2dcaca46d3869599988480138914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 849KB
        • SHA256 6abc8c45295d6b9a5c188a23d8be70f29e3b0408d224d052c6299c17ce609094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 5a2ac809f90cb76bb66762dda45dba167f6af963e6de22281697b0ccbe3bf385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 768KB
        • SHA256 1734e5f730df894428e4ab326748aee394bf166600fcd9ed27a8222b2f46415c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 0c277bb6ef0a59dc1c12256e7e0ea38cb0dccd39fe723d688d6ab57550b407f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 861KB
        • SHA256 cb043645a6384302be316a76702f5ab565d953701207533c74711d6820026fa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 72fe76eeae94bfb665feb7284744f3a6d76843d139ec23b20c74763109b47a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 0b3ada2ce0ff16efea02e8207b4eb9d1c0156539970d345a30fcc74ee80d1f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 ed0a6923f357a7b70fe26c16f295d171aab7d05a6b45da8cdb8d5b9ba1adf997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 4b920886a9237348f6af318a9f67986a0a12c0922f4371b494d4c22fd01ee416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 6602cc789db743979ff8e95ff39d55432e62b26461c043c9879ea5729e400147
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 17f7e6c16cf769dba810b9c6d152b717ce5c98710d2ec66e8432da9a107d9740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 90f3c56c2292713a90420a379aeb8c3e8dbbd607422ddef14c3f10d563d15f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 902KB
        • SHA256 987e712b4adc5ae5947bce514a99db2282934a08a982ad810c00b2589ac2dd73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 825KB
        • SHA256 1db5f7b74f11ad49b298c22a573cc2de14c9001dbaf397ed195ad812c770c101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 d4564030ffd5ccd9b68d42fe392e87a02936ccddca62a323f66b2739b5a6de32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 4bea9d969ba9ebee673889757a53e6acd9c5298cf1619b5b5cf9961f3dc39bd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 962KB
        • SHA256 6d4b0ff0ba72e7edfe4c62bffeabddf7db0a105f7787ae56c470e19aa3ba15ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 f9dcd6fc99dec5155becb3651df0ccda90db0516de353f32f3d383aa91d7fc12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4660-0-0x0000000002C80000-0x0000000002D8D000-memory.dmp
        Download

        memory/4660-1-0x0000000001340000-0x00000000013C5000-memory.dmp
        Download

        memory/4660-7-0x0000000001340000-0x00000000013C5000-memory.dmp
        Download