Overview

overview

6

Static

static

3

2026-07-05...ee.exe

windows10-2004-x64

6

2026-07-05...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    135s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 15:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_bdf0f00e56a9e6748c8558a20aa7c38e_coinminer_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.8MB
  • Sample260705-tcp83ahs3m
  • SHA256 44302177a5f1319d1d04ed89c20d8317dbac6a92d57af25242ac74a17280e2f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 45 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_bdf0f00e56a9e6748c8558a20aa7c38e_coinminer_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_bdf0f00e56a9e6748c8558a20aa7c38e_coinminer_elex_remcos_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3168
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_bdf0f00e56a9e6748c8558a20aa7c38e_coinminer_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-05_bdf0f00e56a9e6748c8558a20aa7c38e_coinminer_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1696

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ccmebasenonfipssqlite.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccmebasenonfipssqlite.exe
        • Size 1.5MB
        • SHA256 5b06255072af20ec435845c391ccd5c0fce333944641129fac312795494aff8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ccmeeccicuuc584.1.2.0.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ccmeeccicuuc584.1.2.0.exe
        • Size 1.5MB
        • SHA256 158a32752805c3e60c75f30a78fcdd1e8d501688702fb7f3b79857c20405edc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WindowsMediaAcrobat.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\WindowsMediaAcrobat.exe
        • Size 1.8MB
        • SHA256 63ac9158f7dc777c5ba897e09ad201a658bab2460139258c5fdad1d2f8d17428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VisualMicrosoft.exe
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\VisualMicrosoft.exe
        • Size 1.5MB
        • SHA256 9d47bfa8e74a7e6ec226fcd6db2a7341d18ce36f16d9b97e7cef1252ea422115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DecryptionModule4.10.2891.0.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\WidevineCdm\_platform_specific\win_x64\DecryptionModule4.10.2891.0.exe
        • Size 1.8MB
        • SHA256 4f5fc77054d841ad5bdb0fd39e63e7ffcc0085df84060406558e4a482ca41efc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FrameworkMSBuild.exe
        • Path C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\FrameworkMSBuild.exe
        • Size 1.4MB
        • SHA256 40c37bd57e1eb19f4a4b22bc78a8b22f1340d6aa563d6fa058da3d80eaf4ef58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Operatingnlmcim.exe
        • Path C:\Windows\SysWOW64\wbem\es-ES\Operatingnlmcim.exe
        • Size 1.8MB
        • SHA256 050d0b183d73c52100d95e904fe734785045c7cb99ad47638f237bef9dc9e8f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download