Overview

overview

7

Static

static

5

2026-11-02...er.exe

windows10-2004-x64

7

2026-11-02...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 19:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_e52373d54bfc2436e10655dda935a3c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
  • Size 915KB
  • Sample261102-ynh2cae16j
  • SHA256 814d17de2a8e717e1898146af17a9b9e868aff52edcb2bac1c96edee9461bd23
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_e52373d54bfc2436e10655dda935a3c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_e52373d54bfc2436e10655dda935a3c7_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_play_smoke-loader.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5360

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 4b9929e30e93ced2bcc91f75359be57f1bf382f22571fe631d132d7e8d9093c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 18efc50c98758349a7a550e2038c1bd9a3426d0e76636c9da8ebaf341c7d9115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 bfc3464be6bc58781507f9b3b09fe9f2a874967ac55436e667f048bd32740264
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 09548e3baca9df4b64e639be2090855d2af22ce04e072a07b25dd56b1c1fd1e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 d28bf644ec32d9c0748162661efa314aa19e4cb50ae3b125d9a7231545e87968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 6b8210f09e8bcbb4e0d61419dcd170087db7a71a14aa3776a2c7f8a59913585b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 57cf4a760bdd7cfb9c0a8170439bf43758a7a9d4ee3ae4f54ec51c6a2d470f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 96dcd8c272fbc155b1cf82bd4bc70a3c745ac530410499acf743b38048372d0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 fe894d772f5952dde3f21a2ebfa5f14dc96288e101a4a0cefc02eab95a4a0ee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 4c18f7008018badeb4bc555c70e442c972e071d67fb47d57ae660da60eb3e136
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 ce2df97e8a922680f2b718008457e02b36730cf7795d0791a6035a751dc4b902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 832KB
        • SHA256 a150d00c001afef7020ccc626f4fa35b11dd8d5b0da9f7d99596f27234c71611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 796KB
        • SHA256 a10f6d1ea4b5adad1cf8562c1bf75a3348d804ca4aeefe15093b9fa47bbf296a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 eb8549aa5b8ce8b90df69823e3274606982f850caf50b28ec3053f6a557f128f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 1000KB
        • SHA256 5552a323a816d1ec3862142a5b0c11ce406663111ab3fa286cc35e04e86faae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 934e5d3e2af69d66e6b2318f8a730b55b4094aac439703a77f9285a5e8d036f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 de58fc25abd825a05e554c8afac661ddea3461d9f11afd5580f8bc0f81673185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 c0b59ac7f11df12c0b39ed92dcb3b6752d3312d8793d51b202ad658cb806f89e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 72d034cd367ee4b2166c09477cc89165d0d3edf514c61a3ef8937876d9c1499a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 4c828da6abbdcc0aa1749c524ac00e32b5c2ec47c04d7e4622dca3d1a97eac5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.2MB
        • SHA256 2969fb694e89b5b82785b8ca1a6d35bae23943f1beca41a673dfeda71df85af8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 948KB
        • SHA256 a5562a3581f021a442efb3945609508085404a6860c19e4c2431a0795cd1913e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 932KB
        • SHA256 0b3839b8605c1220bf4782d956f574644b66126f4a10399f35f5b630e00cfe38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 940KB
        • SHA256 e44132b22b95125db78d31d10b5ec20db470e33d5178252593fccd5ee6047ad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 804KB
        • SHA256 4a986450677b5f00edabd42e701bd0177614141486716a8562af942f47f03f72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 bde356de0d9f6330778cb66dce2f4c9c3ce1b83b48c63ce618dd5d86ed882560
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 964KB
        • SHA256 45d87c635985aea3698ac9eb157ecd7e3bf2663585461b956b4a85c3c926e482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 e795cf679cbd9c7029934148d3fd2b48d1e9e660933351f2520a2e343d13d0c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5360-13-0x0000000000160000-0x00000000002A1000-memory.dmp
        Download

        memory/5360-0-0x0000000000160000-0x00000000002A1000-memory.dmp
        Download

        memory/5360-6-0x00000000031D0000-0x0000000003255000-memory.dmp
        Download

        memory/5360-7-0x00000000031D0000-0x0000000003255000-memory.dmp
        Download

        memory/5360-1-0x00000000031D0000-0x0000000003255000-memory.dmp
        Download