Overview

overview

7

Static

static

3

2026-10-25...at.exe

windows10-2004-x64

7

2026-10-25...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/10/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_bdd33aee074cc3b0506773e1630e9809_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 3.5MB
  • Sample261026-raw8gset4t
  • SHA256 c2474d756eac5dd546f3724bd8ca5bb92694410e101a25c46999a9830ce1fdd5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdd33aee074cc3b0506773e1630e9809_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdd33aee074cc3b0506773e1630e9809_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4600
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4548

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.9MB
          • SHA256 19ff4823e42ff8ae7f7e5fdc765c8359cef395ea2861577205414f9154cc0419
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          • Size 1017KB
          • SHA256 6d3a7d93e6cf6db332e74b60bcbd01a1858581601f0da9c8c20594e11e412cff
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSE.EXE
          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
          • Size 997KB
          • SHA256 29c2457e06e8968c48164075fbf8f491ff3ce6e609446bec27e2166776db365b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 3.0MB
          • SHA256 887cc3063b2063ac7afed18ea1dc0eebf608fb5dde27d8795a3322f53597bf49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MsSense.exe
          • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
          • Size 1.2MB
          • SHA256 22fed54c9e9d05887f57b27a1e26e522861ead8b5d76063e9d73c9c467287a06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NisSrv.exe
          • Path C:\Program Files\Windows Defender\NisSrv.exe
          • Size 3.7MB
          • SHA256 34ccd059368b60f5384f2a7510123de4422bf8da936fb28dca7c426e9e2f5a6b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmpnetwk.exe
          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
          • Size 1.6MB
          • SHA256 83d65031c8caef436baa5ad14d1bf3e03039e3ead612b9e25b6ba7fb58ceaa10
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perfhost.exe
          • Path C:\Windows\SysWOW64\perfhost.exe
          • Size 778KB
          • SHA256 09bd33e2c75c11608db1928c499aa11379d90e089cacdca73fe2ee15e6e07599
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentService.exe
          • Path C:\Windows\System32\AgentService.exe
          • Size 1.6MB
          • SHA256 f630348b6166642c2031b7aa2e1d10c1dbea596bc59f4e45bd6cc911caa08119
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVClient.exe
          • Path C:\Windows\System32\AppVClient.exe
          • Size 1.5MB
          • SHA256 5b847982ac5a6f411ae237522e4179a3805e48c7b4f72e8338db0a0bb2b887f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GameInputSvc.exe
          • Path C:\Windows\System32\GameInputSvc.exe
          • Size 832KB
          • SHA256 76a7be83e06a16c43372e64594c3dc968db463d1e00a70e9011494f51c0975b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Locator.exe
          • Path C:\Windows\System32\Locator.exe
          • Size 796KB
          • SHA256 71f42ebb56db1091d766fd7ea25416bf1c495627a442bac9b5fdcc3f0a184a65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
          • Size 1.3MB
          • SHA256 fb377ed22594f45d06e66fa24a7934129a3e8366b1a098b327010f92233b1dae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PerceptionSimulationService.exe
          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
          • Size 1000KB
          • SHA256 3a60aeeb9ec012822f59a8bc67129cd0343481ac8ba9979636f96b5676908a5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ReFsDedupSvc.exe
          • Path C:\Windows\System32\ReFsDedupSvc.exe
          • Size 2.8MB
          • SHA256 feb4e4b98b1148eb96bef9eff7adb9c984f02727dffe213574c35e759ca7ccbc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SearchIndexer.exe
          • Path C:\Windows\System32\SearchIndexer.exe
          • Size 1.6MB
          • SHA256 db8655d17b20e57f3477e1b063c6a2d4a81b5a3df69489eddd9c2fc41b09a9b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SensorDataService.exe
          • Path C:\Windows\System32\SensorDataService.exe
          • Size 1.9MB
          • SHA256 12f87c435d3012f7129920e9b19cba31b514ea5a8127319cfdda040d5953e47e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SgrmBroker.exe
          • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
          • Size 1.1MB
          • SHA256 7f5e0965130733ff81ba5ead80582b8c84e4416832e615d735c6c325f7437c07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TieringEngineService.exe
          • Path C:\Windows\System32\TieringEngineService.exe
          • Size 1.1MB
          • SHA256 c268d6f698e49cfdc95dfa4861153d834019ec0dfb71aa88cb5f71532ae83e24
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSSVC.exe
          • Path C:\Windows\System32\VSSVC.exe
          • Size 2.2MB
          • SHA256 60a2badd1c82dfdc63c4a52efdf2b688cb3e84f8f1e716ca255abc7ac7a2864e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          alg.exe
          • Path C:\Windows\System32\alg.exe
          • Size 948KB
          • SHA256 16118cb8df0ea4312a81aeeedfd8381ac48e6fc9406ca08548c2012358c677c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msdtc.exe
          • Path C:\Windows\System32\msdtc.exe
          • Size 932KB
          • SHA256 7aa7ebad8eda999c5cf4326cf1eabc674e1ee8e4b1a991e126844ac6b6a77fa0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msiexec.exe
          • Path C:\Windows\System32\msiexec.exe
          • Size 940KB
          • SHA256 42f72f0fecfc823425058175c14c234d9fd6b5d7c1fffaf37b73377d61a1a331
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snmptrap.exe
          • Path C:\Windows\System32\snmptrap.exe
          • Size 804KB
          • SHA256 e8b366c4edf1c11ed026e75bb5e3747e586d4de09fb7ef6626e1245040d6a3a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vds.exe
          • Path C:\Windows\System32\vds.exe
          • Size 1.4MB
          • SHA256 c1ddfbac1e910d0ee8178055b49f7c61e8160fa7720236676bd76d0232882c96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WmiApSrv.exe
          • Path C:\Windows\System32\wbem\WmiApSrv.exe
          • Size 964KB
          • SHA256 4fbfa58aa2aa275ffac2947a17a2442e61d09343eb5836a41065f24a81a1fab9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wbengine.exe
          • Path C:\Windows\System32\wbengine.exe
          • Size 2.2MB
          • SHA256 5f3e68e5882dec7adbc61abadeb5d50ec32af7c43d8f532e5b813c3a07dc254d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4600-0-0x0000000002F80000-0x0000000003055000-memory.dmp
          Download

          memory/4600-7-0x0000000002ED0000-0x0000000002F55000-memory.dmp
          Download

          memory/4600-1-0x0000000002ED0000-0x0000000002F55000-memory.dmp
          Download