Overview

overview

9

Static

static

1

2026-07-08...op.exe

windows10-2004-x64

9

2026-07-08...op.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 22:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_2a3ce5cf555638daaf74601d01a75970_amadey_elex_icedid_remcos_smoke-loader_stop.exe
  • Size 19.2MB
  • Sample260708-2jnb2sa13s
  • SHA256 4df3bf652e00b52153b3ad2acee5fb82a62168c4c7cc736ca3a7c5d951f4d4bb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoveryexecutionpersistenceransomwarespywareupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 22 IoCs
  • ACProtect 1.3x - 1.4x DLL software 4 IoCs

    Detects file using ACProtect software.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 48 IoCs
  • Modifies registry class 38 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_2a3ce5cf555638daaf74601d01a75970_amadey_elex_icedid_remcos_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_2a3ce5cf555638daaf74601d01a75970_amadey_elex_icedid_remcos_smoke-loader_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c C:\Windows\system32\expand.exe *.cab /f:* .\
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Windows\system32\expand.exe
        C:\Windows\system32\expand.exe *.cab /f:* .\
        3⤵
        • Drops file in Windows directory
        PID:2828
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c schtasks /create /xml ASOS.xml /ru "system" /tn ASOS1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5148
      • C:\Windows\system32\schtasks.exe
        schtasks /create /xml ASOS.xml /ru "system" /tn ASOS1
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1268
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3108
      • C:\Windows\system32\schtasks.exe
        schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "
        3⤵
          PID:5072
      • C:\Windows\system32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c schtasks /run /tn ASOS1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:436
        • C:\Windows\system32\schtasks.exe
          schtasks /run /tn ASOS1
          3⤵
            PID:1664
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c schtasks /delete /f /tn ASOS1
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3012
          • C:\Windows\system32\schtasks.exe
            schtasks /delete /f /tn ASOS1
            3⤵
              PID:708
        • C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe" SRManagerSOS.exe 1
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:236
          • C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRManagerSOS.exe
            "SRManagerSOS.exe"
            2⤵
            • Drops file in System32 directory
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:1644
            • C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRServerSOS.exe
              SRServerSOS.exe -s
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2876
            • C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe
              "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:5860
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Windows\Temp\bd2_request_1380b898fd3f74.bat
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4772
            • C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe
              "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:2072
            • C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe
              "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4540
              • C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRUtilitySOS.exe
                SRUtilitySOS.exe -r
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2844
        • C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
          "C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:908
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5348
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:6084
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2420
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:5984
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:4532

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                prep_Activatable Class_Hermes_perf.cache
                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                • Size 599B
                • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                01_sysinfo.txt
                • Path C:\Users\Admin\AppData\Local\Temp\splashtop\sos\01_sysinfo.txt
                • Size 440B
                • SHA256 4b525ab0dcac784cc42e6857768b69458da189319f70081c3475741488b2eec8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                launcher.txt
                • Path C:\Users\Admin\AppData\Local\Temp\splashtop\sos\launcher.txt
                • Size 234B
                • SHA256 00da9a93544d570ec53a4b83f3d1d7733452c9b270660a9ac6867897cdd1128e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                unpack1.log
                • Path C:\Users\Admin\AppData\Local\Temp\unpack1.log
                • Size 4KB
                • SHA256 d1a79507783f35aa32182fc22cf6af6cd55b49fc752f437c7cc8b50fcfb96023
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ASOS.xml
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\ASOS.xml
                • Size 2KB
                • SHA256 1008bce6f93a3863164b0fea34bea07bd6ce304dffafac5615dc52bbb675bd47
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Launcher.exe
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\Launcher.exe
                • Size 199KB
                • SHA256 627798fc9cee75566928e0ee14e5be73651509c94fb5cfd44511048fd16fcbbc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRAgentSOS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAgentSOS.exe
                • Size 3.0MB
                • SHA256 bb6c4afa3fd59192c7fdcb3e4482f54028c6624be06c7e4113e04c6046857d0b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRAppPBSOS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRAppPBSOS.exe
                • Size 2.8MB
                • SHA256 96de45f42364fc67b5ccdb46692da5d347aac249bcdfebc1e497ce694d07e4a4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRClient.pem
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRClient.pem
                • Size 5KB
                • SHA256 33fe8889070b91c3c2e234db8494fcc174ecc69cfff3d0bc4f6a59b39c500484
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRFeatureSOS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRFeatureSOS.exe
                • Size 4.7MB
                • SHA256 ad00e66348c8fcfa656f6e6ff6943a275756d9aa782aa0af6525a789f4ef3b90
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRManagerSOS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRManagerSOS.exe
                • Size 2.0MB
                • SHA256 73ef0d89b04262d64a2f509d5877a627494e03fb25ccc3209a0f9f00e08c2d7c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRServerSOS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRServerSOS.exe
                • Size 5.2MB
                • SHA256 290ded9f8851808cc1210294fc3b773202f793695ab682b16cad784cccbd0694
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRSocketCtrl.dll
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRSocketCtrl.dll
                • Size 527KB
                • SHA256 6fc25bf2fdb71e79468e7e705515267c27b0377e4f8fb6c38aa689f3a711c870
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRUtilitySOS.exe
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\SRUtilitySOS.exe
                • Size 172KB
                • SHA256 060e5af5161fa20b99ad633e8fa476766356077bf89d8b65828b4afb82706b34
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                avutil-60.dll
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\avutil-60.dll
                • Size 521KB
                • SHA256 611c5a353f80cc3a78cea637a159b099995e788e44c9c4e0356da71c65660f85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRAgent.sqlite3
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\db\SRAgent.sqlite3
                • Size 216KB
                • SHA256 fc82e40f2677937a18e901d10eaa47cf0f942f632d2a311fe8c306a01d42e71e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SRAgent.sqlite3
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\db\SRAgent.sqlite3
                • Size 216KB
                • SHA256 f8c8c7dec5386b237116973e78a03582817e53d786a7de5855305f8878e4e9d0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dbghelp.dll
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\dbghelp.dll
                • Size 1.0MB
                • SHA256 4b890de3708716d81c1c719b498734339d417e8ffc4955d81483d1ebc0f84697
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libcrypto-3.dll
                • Size 1.7MB
                • SHA256 c6eb36a9f09d5c8eaf42c851306ffb886dbfc330c2b9c8eef4bf9697689428dd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libssl-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\libssl-3.dll
                • Size 489KB
                • SHA256 bdbfdc55885736fe9657d5a2834550f8ff28141350e05279716ea321805dda39
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                stprinter.cat
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\stprinter.cat
                • Size 17KB
                • SHA256 eb61a0e06bf8c69597f9bb1909e3eb4f926e49800c3f9721fda3007993da5ee7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                stprinterx.cat
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\stprinterx.cat
                • Size 19KB
                • SHA256 84e1a32b4975e92477cf6a36d8931921da735ef988e0c09a2b056f2904541b1e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                streamer1.cab
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\streamer1.cab
                • Size 18.7MB
                • SHA256 854f41ded9e937717734e628116205986a98bc7e0247101dfa41c2823051f5e3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                swresample-6.dll
                • Path C:\Users\Admin\AppData\Local\Temp\unpacksos\1\swresample-6.dll
                • Size 191KB
                • SHA256 999674324c39f1c9ed41ced9c6a67fef7703dfb1431bdf2096f4e362ad7e3f83
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bd2_request_1380b898fd3f74.bat
                • Path C:\Windows\Temp\bd2_request_1380b898fd3f74.bat
                • Size 159B
                • SHA256 c1bd0aa4adc1d5be2b087b17d803a9c93a05d5c18c1a5095525174631c5640af
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/1644-466-0x0000000072730000-0x0000000072C5E000-memory.dmp
                Download

                memory/1644-782-0x0000000072730000-0x0000000072C5E000-memory.dmp
                Download

                memory/1644-479-0x0000000072730000-0x0000000072C5E000-memory.dmp
                Download

                memory/1644-465-0x0000000072C60000-0x0000000072DF9000-memory.dmp
                Download

                memory/1644-436-0x0000000072730000-0x0000000072C5E000-memory.dmp
                Download

                memory/1644-435-0x0000000072C60000-0x0000000072DF9000-memory.dmp
                Download

                memory/1644-781-0x0000000072C60000-0x0000000072DF9000-memory.dmp
                Download

                memory/1644-478-0x0000000072C60000-0x0000000072DF9000-memory.dmp
                Download

                memory/1644-385-0x0000000072730000-0x0000000072C5E000-memory.dmp
                Download

                memory/1644-382-0x0000000072C60000-0x0000000072DF9000-memory.dmp
                Download

                memory/2420-239-0x0000020914170000-0x0000020914190000-memory.dmp
                Download

                memory/2420-195-0x00000209001E0000-0x00000209002E0000-memory.dmp
                Download

                memory/2420-225-0x0000020903C30000-0x0000020903C50000-memory.dmp
                Download

                memory/2420-206-0x0000020903A70000-0x0000020903A90000-memory.dmp
                Download

                memory/2420-209-0x0000020913E00000-0x0000020913F00000-memory.dmp
                Download

                memory/2420-193-0x00000209001E0000-0x00000209002E0000-memory.dmp
                Download

                memory/2420-194-0x00000209001E0000-0x00000209002E0000-memory.dmp
                Download

                memory/4540-451-0x0000000071650000-0x00000000716FD000-memory.dmp
                Download

                memory/4540-450-0x0000000071700000-0x00000000719E4000-memory.dmp
                Download

                memory/4540-545-0x0000000071700000-0x00000000719E4000-memory.dmp
                Download

                memory/4540-546-0x0000000071650000-0x00000000716FD000-memory.dmp
                Download

                memory/5860-404-0x0000000072730000-0x0000000072C5E000-memory.dmp
                Download

                memory/5860-475-0x0000000072730000-0x0000000072C5E000-memory.dmp
                Download

                memory/5860-474-0x0000000072C60000-0x0000000072DF9000-memory.dmp
                Download

                memory/5860-403-0x0000000072C60000-0x0000000072DF9000-memory.dmp
                Download

                memory/5984-452-0x000002BEDF000000-0x000002BEDF691000-memory.dmp
                Download