Overview

overview

7

Static

static

3

2026-11-03...at.exe

windows10-2004-x64

7

2026-11-03...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/11/2026, 23:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-03_3a76a8d8e794f1a9852c1468df953111_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 3.5MB
  • Sample261104-3ea2lad19x
  • SHA256 59ca7520b61f03e1d6d93490357cecd498d94c8c5aa2f412dd1f2cf000c2f5dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-03_3a76a8d8e794f1a9852c1468df953111_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-03_3a76a8d8e794f1a9852c1468df953111_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4276

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 a4d1eb75178c8f7c18fc54dc1fea3e888e59c09197e5536e31d4388a44176796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 012324b5b83406d8f53a63f2580c1e7e24f5f1d2e1ee69de74f3d4db81fcbdf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 02bb03455e6872a0e9c50513a312c26478a9b2fa383b1be8fe406b76af99bb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 db06f54704adbd2a428aa8211b0131bc875a418271bf32a7557faa89b67de624
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 072c060053f8dfc06e924d8d08ef450aee048c79c744fe44e47671d08ce9ff90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 fa278834197c3b85a4771a980e32ed8d29d8f26607e9e0b5a47703c2a0e69d21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 849KB
        • SHA256 3ca67ec5f5ae2fbca8c9224d516587616ef122ba5c4b082dea4d2a2bec872dd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 fab99907ead05bbee265a677e0631dd689bcf4173d6bc33bd0978c83845ecd30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 768KB
        • SHA256 27f075c1900e6df70579e34cc4efc703cdc00a13f784abe4460a22af433c2dbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 861KB
        • SHA256 0a7d081b9804deeded8e5e7161e95132db54d63ca2d2fb35122de51a257c19b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 0b0cf7f671e09b86f8b35829e100c66bf95dfd6f4ad74b2fe6ddff9b43fd584c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 6f669673a29a3cc3721e55600ce84748e129acfd9acaca7c6a3f4dcca997d458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 a11dea5eb6cb78db987ee25b3d07254ac876b75a0864aa3870331120bbf83c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 79ebd5531f060775b7bcdd8f0b4aeb87f40d09e91a338e2202aedd63fd04eb4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 902KB
        • SHA256 67732e6f12b24dee14e61d373a4ba2db718172e6b7b266829be2ac262f080987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 825KB
        • SHA256 f1a0a0d8c6c2a3962da33ccad7df41616a71215c95c9d68da8cff2cef67831c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 c7a9798f51b1c7dc8f39cbb792d07624cbf55eaa18ff506cfd2640680ea11d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4276-7-0x00000000031B0000-0x0000000003235000-memory.dmp
        Download

        memory/4276-1-0x00000000031B0000-0x0000000003235000-memory.dmp
        Download

        memory/4276-0-0x00000000030D0000-0x00000000031A5000-memory.dmp
        Download