Overview

overview

7

Static

static

3

2026-10-25...op.exe

windows10-2004-x64

7

2026-10-25...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/10/2026, 17:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-25_a60dc9744126876f37b06e30e5b48262_amadey_elex_pay2key_smoke-loader_stop.exe
  • Size 2.4MB
  • Sample261026-vrcrysft5t
  • SHA256 c66825666cd4157357f66edb11a1418cf8b21e475d3a2de51fbf6cf19026673f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-25_a60dc9744126876f37b06e30e5b48262_amadey_elex_pay2key_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_a60dc9744126876f37b06e30e5b48262_amadey_elex_pay2key_smoke-loader_stop.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:996
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2108

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.9MB
          • SHA256 4a793b2eb291c18d631cf33dc4f983932af5cd99bf023e21be8852e946bb027e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          • Size 1017KB
          • SHA256 b523593bacaf6779ca9561356941cf282fcf5c6db68ce07b1a460800efe188be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSE.EXE
          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
          • Size 997KB
          • SHA256 61f2c0a453b67b0c4d311ee1842190d63c7ddcf81b442bfddf3d67c917fe0cf1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 3.0MB
          • SHA256 1bf3336efa5a5ec44507399e2939d6443f68c8a57228f1de71d3539b9b5385bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MsSense.exe
          • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
          • Size 1.2MB
          • SHA256 d6fca43f31c5cea697f0924945d13183076df2965584713189e45c22f390126a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NisSrv.exe
          • Path C:\Program Files\Windows Defender\NisSrv.exe
          • Size 3.7MB
          • SHA256 421a2ab00b46d02032a8500f39ee3a433de7f28da32515f4384cb76edfb7baf0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmpnetwk.exe
          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
          • Size 1.6MB
          • SHA256 923d7b3c6a7994df738be69a100fced6a41b657dc188b52b22e4f25c13e2d0dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perfhost.exe
          • Path C:\Windows\SysWOW64\perfhost.exe
          • Size 778KB
          • SHA256 cd4ea2707c9738207275840931beaa5bb05ead410aec037e66624e948453cb3d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentService.exe
          • Path C:\Windows\System32\AgentService.exe
          • Size 1.6MB
          • SHA256 33f318cdae6097b5f10ffc00bcdd844a7282ca01b96133a7d0b74fc42dd90858
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVClient.exe
          • Path C:\Windows\System32\AppVClient.exe
          • Size 1.5MB
          • SHA256 5b97fd82627bec5736c2811e87b9d2cd8372f6484173424a864cdb80a0e87804
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GameInputSvc.exe
          • Path C:\Windows\System32\GameInputSvc.exe
          • Size 828KB
          • SHA256 c55198127df1192919d1f75bb90fd83d27ddf82eeaa29064d1cbdedd6238c6b4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Locator.exe
          • Path C:\Windows\System32\Locator.exe
          • Size 792KB
          • SHA256 97682aab7582b129d9413ac10f6656fd79a78e2ab7637c455144ba362a522c2c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
          • Size 1.3MB
          • SHA256 34e8bdd74d8c9dc7ab0455d10f345763f4a96ac9b75ea8e665877bd6a04d4757
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PerceptionSimulationService.exe
          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
          • Size 996KB
          • SHA256 fe173df32487db789f0f4d7209e3857f0f88d96c3bc99899115138ebe256d4c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ReFsDedupSvc.exe
          • Path C:\Windows\System32\ReFsDedupSvc.exe
          • Size 2.8MB
          • SHA256 737b1099d9ff1547642d3a95d58d33edca3c67592f3f855cb3b6defd88c1c4e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SearchIndexer.exe
          • Path C:\Windows\System32\SearchIndexer.exe
          • Size 1.6MB
          • SHA256 0fd64d7aa5af5317fc202d6073d82add63c4942e5f01966044bf75ead30f648e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SensorDataService.exe
          • Path C:\Windows\System32\SensorDataService.exe
          • Size 1.9MB
          • SHA256 834cd1376b4883ef988118c26d42219122eb85b59f1329bf3d517ab7d95aa94f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SgrmBroker.exe
          • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
          • Size 1.1MB
          • SHA256 d523f527822c505c00ccc283df57aae4656d1ed0a8721b2aca539c7be5849b04
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TieringEngineService.exe
          • Path C:\Windows\System32\TieringEngineService.exe
          • Size 1.1MB
          • SHA256 edddfb858e37cf631bae1e9d55be4d427e22a4ad9adc61fc0ae6a9843d451c44
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSSVC.exe
          • Path C:\Windows\System32\VSSVC.exe
          • Size 2.1MB
          • SHA256 40d75312df32fde62a0f4e0942d68d7c9f3126ad28c71bb44f57a2c0bd1f89ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          alg.exe
          • Path C:\Windows\System32\alg.exe
          • Size 944KB
          • SHA256 c933b63d4a2a9be30f88be3569cd354203c6d332c3544f36c5f8b67b4240373a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msdtc.exe
          • Path C:\Windows\System32\msdtc.exe
          • Size 928KB
          • SHA256 244e7ffab7a7323797d1e08d959855afe2315fe23e969e650f18384de4776ff2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msiexec.exe
          • Path C:\Windows\System32\msiexec.exe
          • Size 936KB
          • SHA256 29e055a419fb872f3e7b04ce1165e16e4dfc6599569193ec17e1ef5a5f2c3eb9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snmptrap.exe
          • Path C:\Windows\System32\snmptrap.exe
          • Size 800KB
          • SHA256 87a698315d0c9b6317270c70ebdb16517d2efb70d00f8ae3c7d6d1baa38b3243
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vds.exe
          • Path C:\Windows\System32\vds.exe
          • Size 1.4MB
          • SHA256 b922e05d0bb66b4a090762ab8a6d2c519ce57faaed24196ceb1b92cecb9a2838
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WmiApSrv.exe
          • Path C:\Windows\System32\wbem\WmiApSrv.exe
          • Size 960KB
          • SHA256 b3de8c7f3d9c678e5759aab6d3231f77e54556a8cc46e5c9d4e35dda5c5a4ce3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wbengine.exe
          • Path C:\Windows\System32\wbengine.exe
          • Size 2.2MB
          • SHA256 e2084ffd67f4e7347233b01b583a2f59065a06a2058650d9af515a9993aa54e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/996-7-0x00000000032F0000-0x0000000003375000-memory.dmp
          Download

          memory/996-0-0x00000000033B0000-0x0000000003569000-memory.dmp
          Download

          memory/996-6-0x00000000032F0000-0x0000000003375000-memory.dmp
          Download

          memory/996-1-0x00000000032F0000-0x0000000003375000-memory.dmp
          Download