Overview

overview

7

Static

static

3

2026-10-25...at.exe

windows10-2004-x64

7

2026-10-25...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/10/2026, 13:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_c2376077d32c7e6ba30d80abed9fbaa5_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
  • Size 1.6MB
  • Sample261026-qlstrsw1ct
  • SHA256 d2c2e7a659a770d568bd38f5ad338fbcd32edd3e57c2819ed47fa6d6aecd8cff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_c2376077d32c7e6ba30d80abed9fbaa5_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_c2376077d32c7e6ba30d80abed9fbaa5_amadey_elex_luca-stealer_medusalocker_njrat_remcos_rokrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5860

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 e4426720a05c28023207014cd399dfc2eb8da0c3284932158e9ab0be8bf1cf2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 ec0aecb9ac79b0c3103af15e7fe3af7007fcb76f45661c18ee2abf3552a98ccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 998KB
        • SHA256 f811b3ab59933d6f98a29cc003497f6027d63722b8da842099f2982e1b163fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 6648e0934abfe4b2f20ee0b1b478db0042cc0ddac77cbd77e27aa15407eb1a68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 d0fdb52abe5f97ccb2d20ca79c2d27b5b08d893f7991401b616becba4a0acef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 7b20553e886ee59d92995296edb242cee63432b14f8e21d3d26e83bd566c1247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 c1b13d6b28b12401ccb77cef5b4e3e7a1208ea78ece0cf83847bd982eca02761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 779KB
        • SHA256 d91c03448701d783f8b906e488569c4d1fd6d289d1857d37b588d2b0bb7533a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 c3b522ca6420f30e06925a7a7db3a83667c6d230f8ea50f59520656a2a7e539f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 6756148c24ce0578867eeb64683d864b7d46299810b0616e1289a57c23bdde5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 66da63037fc78bd1b8838b211d15b302293e49a7a289f930a12fb4227e03d4c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 796KB
        • SHA256 42e2d14d33c1756791ce9187b31eae5ba7ccfc89cca0c8f4058cca69e159f3ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 ab67f08901cd17fa36a413eb1749f042b6232e063cf8caa58f54625a88bc75e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 4f3b97c52d04b6596d5d2f5c06ca22b89faea2ad4d44517fb38cfa89b0e542ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 4de698145175a265d41728cf204027e797abe370bb72081f98ff64ebb3ef4e35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 d7d80546b5c0ba457e3e05550bc09964b53d5d70e24d87736b448b10d124a558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 a03e3877555d53c856937cf36c6a92a9c423df05c0cd1ae24d902fb3d5cd2a57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 a7681e230aca4c755170f5aae3775ff4bce02b2d6dece84e9ae9c76a03a0b762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 39ff7a2ca68121930b008b09973107fad8272089e35562d47742b6a9e85c56e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 3feef2a39be9d6dddf79569e43017599953344bffb27b40db6e433b79b369e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 2aa95c7dea49698d7df28f986e95c4429ee901bec37831b3c5d611083acc2f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 3ea85388e56d69760c9d568453b2f5972a849b4489414e8d80e2940775e812c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 940KB
        • SHA256 ec4d015f24c2d49198827096f3481b30a5a7d85c042654858379a0993b75534a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 d869bc20fbd6694b59ce697df6222c89c1a29ce462ffd20a447108291a6bfd9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 75cf4b085ff53026038b18483c60f87fd115135583edc09f7a4bef889821a2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 5a13b44ae9354437a524a1ddb1e821c813e1592a144b24474959ed894c721ee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 745d42d3e913f8d2e78314852b3219cab7d10575a0817afd5637a13279509484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5860-7-0x0000000001AF0000-0x0000000001B75000-memory.dmp
        Download

        memory/5860-6-0x0000000001AF0000-0x0000000001B75000-memory.dmp
        Download

        memory/5860-0-0x0000000003340000-0x000000000344D000-memory.dmp
        Download

        memory/5860-1-0x0000000001AF0000-0x0000000001B75000-memory.dmp
        Download