Overview

overview

7

Static

static

3

2026-11-10...at.exe

windows10-2004-x64

7

2026-11-10...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-10_f48a71cc7482a208ef9a98c05e098a87_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 3.5MB
  • Sample261110-e9v39ach47
  • SHA256 23a2f226f892bb37d2358299e56567f8418b63b7f695b99220a1ff0cfbdfd99d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-10_f48a71cc7482a208ef9a98c05e098a87_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-10_f48a71cc7482a208ef9a98c05e098a87_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5432

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 c4ec172a13bf8cd67d6d26dbd691505b7c2ec412f9e7176d10079cd8994bfdb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 d7e89214e0aed9f14be87191f8bcda979369cf7360cb39c15c41234149fd7b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 996KB
        • SHA256 6b80f359cb62bf9d32fd639e2f789d1d694acef4607798c404b65e42952d3f85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 6fd30782ca6df4a6612495890ab3c65a2c2c69e280a516a903a18e2b3ac2b55c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 daed1bc1a2869975b26b2ad5b23d41131df3e87ba8701508d12de34cb7d31a2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 ab629594322a5a3bfcab040e8297f4f6d7d9468baccf31d8c1e8c7ae7c681442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.1MB
        • SHA256 32cfba92a983eb5f2966b449935a8c8a80584627ac9ef67084c347c5c3da4331
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 d009c1b44ffb0211ef75cc51771483892ebfc3738f87a7dccc5fab7beeae42a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 b63c70aa2287dcdb0452ce5dc389daf9a4aa8fe4cda34cc5df3ce75edd23e2a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 cd0b7473930464cd263cc74011a9d9c058cbf4d407cdb2375564663f20da6038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 4d5e9d3c7b848b97fcdaf99318d22b6621a6b086bef800d543126a61c613602c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 33d9197ed878d8589f11cf136c42a93d3f2ea25f0b6b90291475d3093ae206e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 5619755db94f31e841a86445571dfc5593a7a074c33207d2d9ad87f441eda7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 914405810774fb8b0134864df8e0965eb65f90695089e08d8dc4c9f8ba375c23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 a164bd89a425a3f6a4f9a380f720db35fb9de9cf7efd1e822eb34eaa1d77a256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 63ec67d0bd2c633cfc5fb2ecd8657699935aa4fa204a2e88c56c299e6db07dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 be4a184fb72a0cac546d39b9f7986fc46d5db403aef1015049935f2a6e953279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 0b65524cba6aade504c9838797d703dfb3482283c8299fa6daea66ab238bcaf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 514fa84c5ade0f348311c5ca67d0007c1b576858849003bddc09d8266726b4ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 2e4cc0bcb2dce73159a2310462a3c821e65cd8613312ac41e997cd15e360de47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 1eadbbb93d27b902f08b8b2e6e11c581e322949326d9d268b4b96f730ac49b52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 f0c7870861087ed28fbe1958fd3c9127cba27088069a5d935275194e42ff40af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 169113f5c47235207f0ec208af596e07b07ffd2a281f194bc015fbab976a87e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 4c8d6904a838f452a74490fa5918536afcc8d2052c9ec45f0c8b6e2c12e7a076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 3ceac58a9ba2fe237e4ec163b113984ff5ed5a9b54220f9e303bae063da52dab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 bf83352a30930a2c79aafacbeff79cd79f0b3cddd3dbd81d5e309a5d11b01db4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5432-7-0x00000000030D0000-0x0000000003155000-memory.dmp
        Download

        memory/5432-6-0x00000000030D0000-0x0000000003155000-memory.dmp
        Download

        memory/5432-0-0x00000000030D0000-0x0000000003155000-memory.dmp
        Download

        memory/5432-5-0x00000000032A0000-0x00000000033C2000-memory.dmp
        Download