Overview

overview

7

Static

static

5

2026-10-30...er.exe

windows10-2004-x64

7

2026-10-30...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 15:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-30_d8ca709e62eae34fce22cebb4becaaae_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
  • Size 916KB
  • Sample261030-ssmmfazz2j
  • SHA256 40ce3ce024cecc6a6a1b80391da4a509ae40b1125e2446dc60d85c3475f0a9e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-30_d8ca709e62eae34fce22cebb4becaaae_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-30_d8ca709e62eae34fce22cebb4becaaae_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4580

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 e335e749d80abe6bdc345196a03fd7eee4c021a3a26427956e2fd41e1de3fd5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 359188d2203651a74ca719540842376756db27db695e05c826c3d752b2bfb0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 2968db1ab0752c9065d738513354853b6f506260bf151227276697fb31a3019b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 9434fef6da2d3dcae7030472ac1cbcaa9a0356f7e0f5f49574820946242622ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 6683049473aae9640408095fdca5193654d8a8687c3632d60f3d78c46fc3a0a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 14c4785fc0366e8f0b84c3ecb08adb545ecabd9eb9b5963e8b0f22ef8bfea5b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 896ac8a60b450b58961d9490a5e59203578acc2824e89d191f9cf4cfeb07a90a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 ac25f458a825a88e45c45d42214ad50fe5787f6c7b9647ab44e3fc1084419569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.6MB
        • SHA256 fae6ba361c4dccdbd4818a5e15997ad4784b42f734c7d1644a5f6b9dbb2c5b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 c08d9e1fe39128609a3e7a7c843c77a8d1a8bf5c0fee3bd4daebdc57af214061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 422b093524f57b6dcb7a3b93e44a77309a1fcada7956959d7e1f087a2e727940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 35bcb8d065f54d73bb53c40d1fda5ac68d00d5c2fef457eba4fdda0a5bd7c640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4580-0-0x0000000000E60000-0x0000000000FA1000-memory.dmp
        Download

        memory/4580-13-0x0000000000E60000-0x0000000000FA1000-memory.dmp
        Download

        memory/4580-7-0x0000000002A40000-0x0000000002AC5000-memory.dmp
        Download

        memory/4580-6-0x0000000002A40000-0x0000000002AC5000-memory.dmp
        Download

        memory/4580-1-0x0000000002A40000-0x0000000002AC5000-memory.dmp
        Download