Overview

overview

7

Static

static

3

2026-11-09...at.exe

windows10-2004-x64

7

2026-11-09...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 19:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_57852cf913f5577ff6ba9a3ffb729669_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
  • Size 3.5MB
  • Sample261110-xtds5sab53
  • SHA256 de884a79ceaa384512092894d9e8e568008e180f2ae782e135843e05d5435a8d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_57852cf913f5577ff6ba9a3ffb729669_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_57852cf913f5577ff6ba9a3ffb729669_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5968

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 df869408ef0094aeaef092952c0bd7d0ae786a0e84692aba3dd874d83ec4c495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 f816aaab230450ca09a7e21591adec9806f016f61908e66107a6ad4a45594c69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 bd0a00614e55dd1d0fa8c43e940bce843f016fc6ef7be4ab43f1da0286360348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 599e9cea662d3041fa6bab0650b90f9498af43536bcd751af0ee8d528efda336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 2ddd2ae904fa6499977d042d19415194f6497bb1518eb4fc9849990a1db4fe4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 9cd321639aea0d5b344a364a334dc18201ddd8ac35615dcbe128b74806791830
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 b7028e36534bc845d21230b07caccd4d8bcb144e80d137d06cfe789110f1156a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 29344f9c409c7190393f5a8cdc90460f1a1fd49dd1d041802e4403d36e662694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 8e5ec34d390ba4ec5f3779b66aebabc0dbc7e757135f4438932bff10f924b70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 a6b5c0074243044bfc719593d7b713024a01115e03717bf0864ffa9583778c78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 709fe6251cd8675765851c9bf06a0d7d8b56764a6d3a31fea40f27c692d28562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 a50eafad728450fb032d02891bfb07af66ed0be12dd5191c4b209638bf826912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 4c9fcf23091a805f3b924e6960516d1d479cbcf717e254e9a4ad97b5fdbc1d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 9dad8ca88b32e960f4c9b9b0656946d977c9ea078498501bbaa2ce71fabf5aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 050aeff7e6057d10ffa01516fb19270cecca465196236f1bad18c8d7999534f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 e8953aa2e732faf170745e2bfa318c8b95e3d847b75526a913f1cfaece6b4111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 c1f03336c3e0cf18262b179411873e7f2441de180fb87d3f65ebc2dd6e8d670e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 69c20918f68af997f6dd60bcf837a5a95785999368d6a77b6e74d9a64547691e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 581321cd9a51a371708389b7039168e326a242c1ca12cf79cd46a8b0c1245085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 6a4d564033e4fa25b19aa2b13089e21c39504eece0f5856ee8e47463cb63051a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 e2990ba620985e324a5f02e1af2bafa588fbc0d64e9427dd1ec963169fa7833a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 83b06ee5c35d5804d62f8c88b27ceb97643860c49c7367c6d1878a0e4e0e7f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 9fadbb93aae1defef03c4219b6e3e6689df1926922c74c29faaea4d78ea7fcdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 b54ca872dbaed12adb727ae72ea7db49b90469d838b927f264321141aaffd29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 414b1d6cc09dbcfc8062b5fc2ab0688296afdc6365c447a1616d9c13c38a19b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 b5bf9fb9755b4504c8baa0e301b786353be61559dddcf75f729e50ea9baf8d38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 82888f308cec4ae87d61a4267463f13e4ccb65a2474af7feb379377aeb490c1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5968-0-0x0000000003780000-0x0000000003849000-memory.dmp
        Download

        memory/5968-7-0x0000000003900000-0x0000000003985000-memory.dmp
        Download

        memory/5968-1-0x0000000003900000-0x0000000003985000-memory.dmp
        Download