Overview

overview

7

Static

static

3

2026-11-10...at.exe

windows10-2004-x64

7

2026-11-10...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/11/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-10_f48a71cc7482a208ef9a98c05e098a87_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 3.5MB
  • Sample261110-e9v39ach47
  • SHA256 23a2f226f892bb37d2358299e56567f8418b63b7f695b99220a1ff0cfbdfd99d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-10_f48a71cc7482a208ef9a98c05e098a87_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_f48a71cc7482a208ef9a98c05e098a87_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3668

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 1eaf3ba79eac7b4ab209e22e7302668793f47076e755bcbfe05b1f9e7428cc10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 a0a394f3c58b67a414b2e2d60c5f5a47a05059d0846f1d0212cd0eebdbbafed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 996KB
        • SHA256 f23e5db2fa7dcb6603a0773a399d360755a92ca914c8400197edddee5db4f4df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 a172d36a3c2f4e466e82e1f2455bdf299c67637c89d43027243f2f86636cb002
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 27c379b69b1c4a9dbb5146737023ddc765fad3aee484966c149ed42e0bf6c219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 777KB
        • SHA256 5d8c7a122c0ab703014689ccbba6a8c73676a9447f0c8129224e5265d317fc31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 c0ad6814102c8c47bf08d675df560963cf5f6a3111e6141abf1b4a9b80e1bc92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 08a5206ac1ed0309e6b6dd11fea63cf9ef9fd79579289852fac5524d00a1471e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 34c224900af1f508df15fce68f7c056198b4af523185b1c323a4e48901218003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 bd392f339bc2aebea9facb578407f609f16859ee7b26887abcc1903834cb4aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 6a31c72b3c49028290314f5648b7185096caa87c254c613762802f6fdfc27699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 a8a188c31ad8ce8b988dc0c76f67ea49a0d09eeb8b4456aec0b950f0dc968de4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 8d2af2a10c9731d68c887a1fe6a45bb062b70b37e4e7e70eba05ab836a0a5b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 376a83e9ea56dec612e6f5fc7130da0ed9f3b4fcd4c2a966e23816a5633465b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 9d1fc66711c40782f4f226e64e74dd81083f90a9ab0974b2644f7cc256bcd92e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 518a40bb3b72a0a217cfe1e249f98fe9e6cc9915175c4bd117754dfafe75a871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 7b142f2c1b47b772f83aa7dfb6b781931f6ca0f2f87b9bdae001ef66b97760be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.0MB
        • SHA256 9df710d8981bed1c98e5db3dcbf93a8cfe2815e0085a2545aab08a2222c34706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 c206364b78f01013ee1c549b6e165f229c963c165ff5cabee6c757bf92cbd243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 a9a4a936a730ad0bc16d508e8c873dce88dd693c75b0e9bb70ee72e2982aa25a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 553ee85949bb5a200e3a4835cfa3c262d74b2f48f0ca348edba7a3f0095a7a27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 8e934ff74de8cd4ba04e2cd02da7c289436934090278abaffd1d238fbc03385c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 96b85d057c5912c842d8bda4163a4dbe6125614d61f1aeb4061b1c1bee3ca1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 be54a5b8d9e9d588d307d71b81ab05cc88e18a23a092525bec7bd7028650ac39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 961KB
        • SHA256 3fcde9f7eafa6d10fe9bd394cf6c7e6e06ec60c69c9191a9f575fc5daff7e422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 985f067d997615f229c859e67e4559774741bf88661cb037a2f6b9b7c06b17ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3668-0-0x0000000003560000-0x0000000003682000-memory.dmp
        Download

        memory/3668-7-0x00000000033C0000-0x0000000003445000-memory.dmp
        Download

        memory/3668-2-0x00000000033C0000-0x0000000003445000-memory.dmp
        Download