Overview

overview

7

Static

static

3

2026-11-01...at.exe

windows10-2004-x64

7

2026-11-01...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 01:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat.exe
  • Size 5.0MB
  • Sample261102-bys8qset4x
  • SHA256 bfe906840ddacebbebc4c012e8670bf745ec1745d889cf93ee19ca024300bf99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_fde88f9767013528f49197967cf0814f_amadey_coinminer_elex_glassworm_luca-stealer_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4988
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4488

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.9MB
          • SHA256 d22142ecc788e49919435f19216de83ecc55c91e7e0ac6e219e4d1736e5aee8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          • Size 1017KB
          • SHA256 44205294e79b472b66911d1319138ad29de487007f3285dff70782888681cbdd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSE.EXE
          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
          • Size 997KB
          • SHA256 540940c27068efc45023880541af83253946c3ce4bc3347ccd545487fe0ec414
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
          • Size 6.8MB
          • SHA256 e8315345e42bde7de24a3f99a0deb262ff36ed2e62a8726d4a93b6b69c886449
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 3.0MB
          • SHA256 747b483be06831ffdf217d26750cd516e5aeb27e8e5ce32f976baff3c002a9ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MsSense.exe
          • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
          • Size 1.2MB
          • SHA256 5334e4e7c5ddf96834dd8629b574e8891735565b2e403f5adcbe889676a9fd30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NisSrv.exe
          • Path C:\Program Files\Windows Defender\NisSrv.exe
          • Size 3.7MB
          • SHA256 d0ee542d78a1fb5fd06ea116b9d7a4fe08c5b23b7613c69283477cb007c09da8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmpnetwk.exe
          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
          • Size 1.6MB
          • SHA256 9059ec78acc2fd9c87c7c5f3274a6e1cc8353cc54ee1e27b56a8522824a5d20d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perfhost.exe
          • Path C:\Windows\SysWOW64\perfhost.exe
          • Size 778KB
          • SHA256 83f88f670cd29473aa75cade918d74cd92689f3dd532fbe687fbaa81b9e88f9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentService.exe
          • Path C:\Windows\System32\AgentService.exe
          • Size 1.6MB
          • SHA256 d233183fb09457c3f1da669d7baaeb5072d6495104709e9b43427fb691caf6ef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVClient.exe
          • Path C:\Windows\System32\AppVClient.exe
          • Size 1.5MB
          • SHA256 2c8f9ff5ac28ec438754a9f4e352b39361eaf295f9bb3c310c4a79d2fe801ecc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GameInputSvc.exe
          • Path C:\Windows\System32\GameInputSvc.exe
          • Size 832KB
          • SHA256 fe60cd4b1b57d1bb73123e5c081a9221789b85007f6baf1aef09b806e8e94a80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Locator.exe
          • Path C:\Windows\System32\Locator.exe
          • Size 796KB
          • SHA256 8f9106e4a156394e313dcc0065e8b803eb38d236ecd7cd9512661d90b8119f6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
          • Size 1.3MB
          • SHA256 c09d7ab035cf56c8cb0d9b10cbfd8f08748ca3d038256c4b0dbae6166dffff30
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PerceptionSimulationService.exe
          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
          • Size 1000KB
          • SHA256 7627b11a61a0da0f1afde5d08329523205a2f87f8c242a5758a966812bb9e2b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ReFsDedupSvc.exe
          • Path C:\Windows\System32\ReFsDedupSvc.exe
          • Size 2.8MB
          • SHA256 cbf6bd9b7e635e05e3c326f720cbd1595c46faa9b9b9d11f0063093b1a1d0f09
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SearchIndexer.exe
          • Path C:\Windows\System32\SearchIndexer.exe
          • Size 1.6MB
          • SHA256 a67ebeee849404cd7e81ad3b5b48d3c64baf3577945c933f29dc17aee7175697
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SensorDataService.exe
          • Path C:\Windows\System32\SensorDataService.exe
          • Size 1.9MB
          • SHA256 311dd721eeb2c4025a70cf79edbb581292371a282586c356a0d1593d2c180c13
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SgrmBroker.exe
          • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
          • Size 1.1MB
          • SHA256 0988a2c57bc2ae572098a9fd42332baaf2c37e89d4f6d86cc1ca6a6dfa21aaea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TieringEngineService.exe
          • Path C:\Windows\System32\TieringEngineService.exe
          • Size 1.1MB
          • SHA256 4b9e4313a6e31d841a4254f827ebfafeeb2534bfd2fcc125df6c568416406dc8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSSVC.exe
          • Path C:\Windows\System32\VSSVC.exe
          • Size 2.2MB
          • SHA256 592e5c10cd96dce50edef0c35362076d05fbd172de1d6fdcb06525e2da1fc967
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          alg.exe
          • Path C:\Windows\System32\alg.exe
          • Size 948KB
          • SHA256 958c91af65d4a572575e27e7a4ea7dd84b7190f8db1974aba15b6fb16d6d0b34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msdtc.exe
          • Path C:\Windows\System32\msdtc.exe
          • Size 932KB
          • SHA256 7950959bdd553d0a93e4d613593d2ebd3b8c3a1fc4fc9a98d5af8068a0281f68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msiexec.exe
          • Path C:\Windows\System32\msiexec.exe
          • Size 940KB
          • SHA256 79fdeeb9c99030896e34e486e0825a7e2049644c9dbb29bbfc58368b7030427b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snmptrap.exe
          • Path C:\Windows\System32\snmptrap.exe
          • Size 804KB
          • SHA256 e18bd6588c220f437e60e7742e42f35de4bee3d6e5aa3d79e843b08a7f899a84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vds.exe
          • Path C:\Windows\System32\vds.exe
          • Size 1.4MB
          • SHA256 cb97e9c4b077e39ceb74fe8fe707a5d3a552dea7004da0043ea98f00c9b9be45
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WmiApSrv.exe
          • Path C:\Windows\System32\wbem\WmiApSrv.exe
          • Size 964KB
          • SHA256 34086856161d5577d2f128529c42cde0360c089607e039641edda19d73f8276d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wbengine.exe
          • Path C:\Windows\System32\wbengine.exe
          • Size 2.2MB
          • SHA256 7cb8466e1b8f125bff00c150da0e61c426979fc2994e0b7f04cc3247783626cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4988-0-0x0000000003000000-0x00000000030C4000-memory.dmp
          Download

          memory/4988-6-0x0000000003220000-0x00000000032A5000-memory.dmp
          Download

          memory/4988-7-0x0000000003220000-0x00000000032A5000-memory.dmp
          Download

          memory/4988-2-0x0000000003220000-0x00000000032A5000-memory.dmp
          Download