Overview

overview

7

Static

static

3

2026-11-01...at.exe

windows10-2004-x64

7

2026-11-01...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 01:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat.exe
  • Size 5.0MB
  • Sample261102-bys8qset4x
  • SHA256 bfe906840ddacebbebc4c012e8670bf745ec1745d889cf93ee19ca024300bf99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2768

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 8eedf78781dd8e175fed6d29c456e319384a632a98b0db9cc389865d1ffec588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 ef4319856fd4b3b9e8f9156d2474d72eaa2a16b8e0f61b0c15905e4269fe6875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 fa2af8302e32b2f489c4c94ca7481c80617bc8a281f0d2a08324c40b98fcdf1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 2.6MB
        • SHA256 0f533f473b042c9380443d3fec7d5202f70017589e688d3809bc56ca87fe023e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 899aab4bdfa68545db65a3fc6802642d77e60e189a73bbf4dd8ab9ea5cfa01a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 60a142069d91755946154c0b0464df036871b44c3fd08e59078d6a50ee199b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 2f5a27929f35df323a108503ae24494ea682e1ba87fe5d4d7f728229130aceb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 502038d852f80b3cf8da44bb8c436fff3003b46ddcaf76653909b9ff87ed4ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 80a7d4883b386f63ee4d5ce12c58511d7cdacb7038fa1c81be5d7cfe7ce0aed3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 849KB
        • SHA256 2979f56cd7041c1111c4fb5551893fe3d647506c3b98e4118117fc85b5b6cf6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 db97c9d4c67c9dceb687f31a4b389545e4cca17b5dd23fdd4ceb8875207f81bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 768KB
        • SHA256 8cb79a3db90d33a6c6023659b6766c75338502148588a06bd1788f4c97eb4b8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 506371418c7f9ae85551c7eb59a071f76cd19959197074f5d4334a1d6a322adc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 861KB
        • SHA256 eb59370e228defb93d67cb7fc71600801045af6ab52a8c9473185e5939ac2d0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 efacbe69990148cb787ed0219e70b66e176852dcc9332e90fb18321113bc640f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 1b748b7066e2757595d8a01d704b0b8c4ef2de71e9050766279e5c75b0934066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 6e1fd9f6bc42841b96f9e2d5246c627a18422d252515148e1d0b59db75c678a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 84add82c0496b6e726ec91ece79528177c126f474a8882332c862a7929cec75f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 8f2baecf9d0a2368e8e1bcaa9f7722832676d2a8c93884a8a459d18bd75ca82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 227e7c7a90380d04aa3c045c732a548c92562d551ae9cc0d1f1637c52f2c0081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 c500dba7c82ff2fd59ea8468d85e5028401e95d5a2870808a2b838738afa2979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 902KB
        • SHA256 139cf7bda4880478bd7a205653aec446991d1ca75337e984f5db2adaad86c9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 825KB
        • SHA256 ca42c96448a7059aa7b3b57cd63e55fdc57f0ea6127359084bba6262dea50e08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 551b27e003441227f2e731d83ec4515593c765007a0f2d210054d553b3d10a0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 3b45821d8ffe1c42fe22f572456e1ad339ade4d12cd2bf24c360a0637bbc1d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 962KB
        • SHA256 763f2a0498b36b06df21d78b4e41c322664580d1f6c838d0128787b51b43afaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 e3bad40afca74581dfd08150f8bcd9c7313ba2bc8e17e4e4da827163e6e86c30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2768-7-0x00000000030B0000-0x0000000003135000-memory.dmp
        Download

        memory/2768-0-0x0000000002E60000-0x0000000002F24000-memory.dmp
        Download

        memory/2768-1-0x00000000030B0000-0x0000000003135000-memory.dmp
        Download